Manage ppapi plugins on a per-origin basis.

Expands the management of plugins to consider origin when assigning
a process. Only passes empty origins at present, so no observable
change expected.

Bug: 809614
Change-Id: I129495ddc94c86dc1c4aa1b3a7942354eabe59d4
Reviewed-on: https://chromium-review.googlesource.com/915182
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540294}

content/browser/frame_host/render_frame_message_filter.cc

@@ -613,9 +613,10 @@ void RenderFrameMessageFilter::OnGetPluginInfo(
 
 void RenderFrameMessageFilter::OnOpenChannelToPepperPlugin(
     const base::FilePath& path,
+    const base::Optional<url::Origin>& origin_lock,
     IPC::Message* reply_msg) {
   plugin_service_->OpenChannelToPpapiPlugin(
-      render_process_id_, path, profile_data_directory_,
+      render_process_id_, path, profile_data_directory_, origin_lock,
       new OpenChannelToPpapiPluginCallback(this, reply_msg));
 }
 

content/browser/frame_host/render_frame_message_filter.h

@@ -9,6 +9,7 @@
 
 #include <set>
 
+#include "base/optional.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/render_frame_message_filter.mojom.h"
 #include "content/public/browser/browser_associated_interface.h"
@@ -18,6 +19,7 @@
 #include "ppapi/features/features.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "third_party/WebKit/public/web/WebTreeScopeType.h"
+#include "url/origin.h"
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/common/pepper_renderer_instance_data.h"
@@ -148,8 +150,10 @@ class CONTENT_EXPORT RenderFrameMessageFilter
                        bool* found,
                        WebPluginInfo* info,
                        std::string* actual_mime_type);
-  void OnOpenChannelToPepperPlugin(const base::FilePath& path,
-                                   IPC::Message* reply_msg);
+  void OnOpenChannelToPepperPlugin(
+      const base::FilePath& path,
+      const base::Optional<url::Origin>& origin_lock,
+      IPC::Message* reply_msg);
   void OnDidCreateOutOfProcessPepperInstance(
       int plugin_child_id,
       int32_t pp_instance,

content/browser/plugin_service_impl.cc

@@ -124,10 +124,12 @@ void PluginServiceImpl::Init() {
 
 PpapiPluginProcessHost* PluginServiceImpl::FindPpapiPluginProcess(
     const base::FilePath& plugin_path,
-    const base::FilePath& profile_data_directory) {
+    const base::FilePath& profile_data_directory,
+    const base::Optional<url::Origin>& origin_lock) {
   for (PpapiPluginProcessHostIterator iter; !iter.Done(); ++iter) {
     if (iter->plugin_path() == plugin_path &&
-        iter->profile_data_directory() == profile_data_directory) {
+        iter->profile_data_directory() == profile_data_directory &&
+        (!iter->origin_lock() || iter->origin_lock() == origin_lock)) {
       return *iter;
     }
   }
@@ -147,7 +149,8 @@ PpapiPluginProcessHost* PluginServiceImpl::FindPpapiBrokerProcess(
 PpapiPluginProcessHost* PluginServiceImpl::FindOrStartPpapiPluginProcess(
     int render_process_id,
     const base::FilePath& plugin_path,
-    const base::FilePath& profile_data_directory) {
+    const base::FilePath& profile_data_directory,
+    const base::Optional<url::Origin>& origin_lock) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (filter_ && !filter_->CanLoadPlugin(render_process_id, plugin_path)) {
@@ -155,11 +158,6 @@ PpapiPluginProcessHost* PluginServiceImpl::FindOrStartPpapiPluginProcess(
     return nullptr;
   }
 
-  PpapiPluginProcessHost* plugin_host =
-      FindPpapiPluginProcess(plugin_path, profile_data_directory);
-  if (plugin_host)
-    return plugin_host;
-
   // Validate that the plugin is actually registered.
   PepperPluginInfo* info = GetRegisteredPpapiPluginInfo(plugin_path);
   if (!info) {
@@ -168,6 +166,11 @@ PpapiPluginProcessHost* PluginServiceImpl::FindOrStartPpapiPluginProcess(
     return nullptr;
   }
 
+  PpapiPluginProcessHost* plugin_host =
+      FindPpapiPluginProcess(plugin_path, profile_data_directory, origin_lock);
+  if (plugin_host)
+    return plugin_host;
+
   // Record when PPAPI Flash process is started for the first time.
   static bool counted = false;
   if (!counted && info->name == kFlashPluginName) {
@@ -179,7 +182,7 @@ PpapiPluginProcessHost* PluginServiceImpl::FindOrStartPpapiPluginProcess(
 
   // This plugin isn't loaded by any plugin process, so create a new process.
   plugin_host = PpapiPluginProcessHost::CreatePluginHost(
-      *info, profile_data_directory);
+      *info, profile_data_directory, origin_lock);
   if (!plugin_host) {
     VLOG(1) << "Unable to create ppapi plugin process for: "
             << plugin_path.MaybeAsASCII();
@@ -216,9 +219,10 @@ void PluginServiceImpl::OpenChannelToPpapiPlugin(
     int render_process_id,
     const base::FilePath& plugin_path,
     const base::FilePath& profile_data_directory,
+    const base::Optional<url::Origin>& origin_lock,
     PpapiPluginProcessHost::PluginClient* client) {
   PpapiPluginProcessHost* plugin_host = FindOrStartPpapiPluginProcess(
-      render_process_id, plugin_path, profile_data_directory);
+      render_process_id, plugin_path, profile_data_directory, origin_lock);
   if (plugin_host) {
     plugin_host->OpenChannelToPlugin(client);
   } else {

content/browser/plugin_service_impl.h

@@ -21,6 +21,7 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/singleton.h"
+#include "base/optional.h"
 #include "base/sequence_checker.h"
 #include "base/sequenced_task_runner.h"
 #include "base/synchronization/waitable_event_watcher.h"
@@ -32,6 +33,7 @@
 #include "content/public/common/pepper_plugin_info.h"
 #include "ipc/ipc_channel_handle.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 #if defined(OS_WIN)
 #include "base/win/registry.h"
@@ -94,7 +96,8 @@ class CONTENT_EXPORT PluginServiceImpl : public PluginService {
   PpapiPluginProcessHost* FindOrStartPpapiPluginProcess(
       int render_process_id,
       const base::FilePath& plugin_path,
-      const base::FilePath& profile_data_directory);
+      const base::FilePath& profile_data_directory,
+      const base::Optional<url::Origin>& origin_lock);
   PpapiPluginProcessHost* FindOrStartPpapiBrokerProcess(
       int render_process_id, const base::FilePath& plugin_path);
 
@@ -104,6 +107,7 @@ class CONTENT_EXPORT PluginServiceImpl : public PluginService {
   void OpenChannelToPpapiPlugin(int render_process_id,
                                 const base::FilePath& plugin_path,
                                 const base::FilePath& profile_data_directory,
+                                const base::Optional<url::Origin>& origin_lock,
                                 PpapiPluginProcessHost::PluginClient* client);
   void OpenChannelToPpapiBroker(int render_process_id,
                                 int render_frame_id,
@@ -133,7 +137,8 @@ class CONTENT_EXPORT PluginServiceImpl : public PluginService {
   // started.
   PpapiPluginProcessHost* FindPpapiPluginProcess(
       const base::FilePath& plugin_path,
-      const base::FilePath& profile_data_directory);
+      const base::FilePath& profile_data_directory,
+      const base::Optional<url::Origin>& origin_lock);
   PpapiPluginProcessHost* FindPpapiBrokerProcess(
       const base::FilePath& broker_path);
 

content/browser/plugin_service_impl_browsertest.cc

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/plugin_service_impl.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/optional.h"
+#include "base/strings/utf_string_conversions.h"
+#include "build/build_config.h"
+#include "content/browser/ppapi_plugin_process_host.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/test/content_browser_test.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+constexpr char kURL1[] = "http://google.com/";
+constexpr char kURL2[] = "http://youtube.com/";
+
+class TestPluginClient : public PpapiPluginProcessHost::PluginClient {
+ public:
+  void GetPpapiChannelInfo(base::ProcessHandle* renderer_handle,
+                           int* renderer_id) override {}
+  void OnPpapiChannelOpened(const IPC::ChannelHandle& channel_handle,
+                            base::ProcessId plugin_pid,
+                            int plugin_child_id) override {
+    plugin_pid_ = plugin_pid;
+    run_loop_->Quit();
+  }
+  bool Incognito() override { return false; }
+
+  base::ProcessId plugin_pid() const { return plugin_pid_; }
+  void SetRunLoop(base::RunLoop* run_loop) { run_loop_ = run_loop; }
+  void WaitForQuit() { run_loop_->Run(); }
+
+ private:
+  base::ProcessId plugin_pid_ = 0;
+  base::RunLoop* run_loop_ = nullptr;
+};
+
+}  // anonymous namespace
+
+class PluginServiceImplBrowserTest : public ContentBrowserTest {
+ public:
+  PluginServiceImplBrowserTest()
+      : plugin_path_(FILE_PATH_LITERAL("internal-nonesuch")),
+        profile_dir_(FILE_PATH_LITERAL("/fake/user/foo/dir")) {}
+
+  ~PluginServiceImplBrowserTest() override = default;
+
+  void RegisterFakePlugin() {
+    WebPluginInfo fake_info;
+    fake_info.name = base::ASCIIToUTF16("fake_plugin");
+    fake_info.path = plugin_path_;
+    fake_info.type = WebPluginInfo::PLUGIN_TYPE_PEPPER_OUT_OF_PROCESS;
+
+    PluginServiceImpl* service = PluginServiceImpl::GetInstance();
+    service->RegisterInternalPlugin(fake_info, true);
+    service->Init();
+
+    // Force plugins to load and wait for completion.
+    base::RunLoop run_loop;
+    service->GetPlugins(base::BindOnce(
+        [](base::OnceClosure callback,
+           const std::vector<WebPluginInfo>& ignore) {
+          std::move(callback).Run();
+        },
+        run_loop.QuitClosure()));
+    run_loop.Run();
+  }
+
+  void OpenChannelToFakePlugin(const base::Optional<url::Origin>& origin,
+                               TestPluginClient* client) {
+    base::RunLoop run_loop;
+    client->SetRunLoop(&run_loop);
+
+    PluginServiceImpl* service = PluginServiceImpl::GetInstance();
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::BindOnce(&PluginServiceImpl::OpenChannelToPpapiPlugin,
+                       base::Unretained(service), 0, plugin_path_, profile_dir_,
+                       origin, base::Unretained(client)));
+    client->WaitForQuit();
+  }
+
+  base::FilePath plugin_path_;
+  base::FilePath profile_dir_;
+};
+
+IN_PROC_BROWSER_TEST_F(PluginServiceImplBrowserTest, OriginLock) {
+  RegisterFakePlugin();
+
+  url::Origin origin1 = url::Origin::Create(GURL(kURL1));
+  url::Origin origin2 = url::Origin::Create(GURL(kURL2));
+
+  TestPluginClient client1;
+  OpenChannelToFakePlugin(origin1, &client1);
+  EXPECT_NE(base::kNullProcessId, client1.plugin_pid());
+
+  TestPluginClient client2a;
+  OpenChannelToFakePlugin(origin2, &client2a);
+  EXPECT_NE(base::kNullProcessId, client2a.plugin_pid());
+
+  TestPluginClient client2b;
+  OpenChannelToFakePlugin(origin2, &client2b);
+  EXPECT_NE(base::kNullProcessId, client2b.plugin_pid());
+
+  // Actual test: how plugins got lumped into two pids.
+  EXPECT_NE(client1.plugin_pid(), client2a.plugin_pid());
+  EXPECT_NE(client1.plugin_pid(), client2b.plugin_pid());
+  EXPECT_EQ(client2a.plugin_pid(), client2b.plugin_pid());
+
+  // Empty origins all go to same pid.
+  TestPluginClient client3a;
+  OpenChannelToFakePlugin(base::nullopt, &client3a);
+  EXPECT_NE(base::kNullProcessId, client3a.plugin_pid());
+
+  TestPluginClient client3b;
+  OpenChannelToFakePlugin(base::nullopt, &client3b);
+  EXPECT_NE(base::kNullProcessId, client3b.plugin_pid());
+
+  // Actual test: how empty origins got lumped into pids.
+  EXPECT_NE(client1.plugin_pid(), client3a.plugin_pid());
+  EXPECT_NE(client1.plugin_pid(), client3b.plugin_pid());
+  EXPECT_NE(client2a.plugin_pid(), client3a.plugin_pid());
+  EXPECT_NE(client2a.plugin_pid(), client3b.plugin_pid());
+  EXPECT_EQ(client3a.plugin_pid(), client3b.plugin_pid());
+}
+
+}  // namespace content

content/browser/ppapi_plugin_process_host.cc

@@ -164,10 +164,10 @@ PpapiPluginProcessHost::~PpapiPluginProcessHost() {
 // static
 PpapiPluginProcessHost* PpapiPluginProcessHost::CreatePluginHost(
     const PepperPluginInfo& info,
-    const base::FilePath& profile_data_directory) {
-  PpapiPluginProcessHost* plugin_host = new PpapiPluginProcessHost(
-      info, profile_data_directory);
-  DCHECK(plugin_host);
+    const base::FilePath& profile_data_directory,
+    const base::Optional<url::Origin>& origin_lock) {
+  PpapiPluginProcessHost* plugin_host =
+      new PpapiPluginProcessHost(info, profile_data_directory, origin_lock);
   if (plugin_host->Init(info))
     return plugin_host;
 
@@ -274,8 +274,10 @@ void PpapiPluginProcessHost::OpenChannelToPlugin(Client* client) {
 
 PpapiPluginProcessHost::PpapiPluginProcessHost(
     const PepperPluginInfo& info,
-    const base::FilePath& profile_data_directory)
+    const base::FilePath& profile_data_directory,
+    const base::Optional<url::Origin>& origin_lock)
     : profile_data_directory_(profile_data_directory),
+      origin_lock_(origin_lock),
       is_broker_(false) {
   uint32_t base_permissions = info.permissions;
 
@@ -286,13 +288,12 @@ PpapiPluginProcessHost::PpapiPluginProcessHost(
     base_permissions |= ppapi::PERMISSION_DEV_CHANNEL;
   permissions_ = ppapi::PpapiPermissions::GetForCommandLine(base_permissions);
 
-  process_.reset(new BrowserChildProcessHostImpl(
-      PROCESS_TYPE_PPAPI_PLUGIN, this, mojom::kPluginServiceName));
+  process_ = std::make_unique<BrowserChildProcessHostImpl>(
+      PROCESS_TYPE_PPAPI_PLUGIN, this, mojom::kPluginServiceName);
 
-  host_impl_.reset(new BrowserPpapiHostImpl(this, permissions_, info.name,
-                                            info.path, profile_data_directory,
-                                            false /* in_process */,
-                                            false /* external_plugin */));
+  host_impl_ = std::make_unique<BrowserPpapiHostImpl>(
+      this, permissions_, info.name, info.path, profile_data_directory,
+      false /* in_process */, false /* external_plugin */);
 
   filter_ = new PepperMessageFilter();
   process_->AddFilter(filter_.get());
@@ -302,21 +303,19 @@ PpapiPluginProcessHost::PpapiPluginProcessHost(
 
   // Only request network status updates if the plugin has dev permissions.
   if (permissions_.HasPermission(ppapi::PERMISSION_DEV))
-    network_observer_.reset(new PluginNetworkObserver(this));
+    network_observer_ = std::make_unique<PluginNetworkObserver>(this);
 }
 
 PpapiPluginProcessHost::PpapiPluginProcessHost() : is_broker_(true) {
-  process_.reset(new BrowserChildProcessHostImpl(
-      PROCESS_TYPE_PPAPI_BROKER, this, mojom::kPluginServiceName));
+  process_ = std::make_unique<BrowserChildProcessHostImpl>(
+      PROCESS_TYPE_PPAPI_BROKER, this, mojom::kPluginServiceName);
 
   ppapi::PpapiPermissions permissions;  // No permissions.
   // The plugin name, path and profile data directory shouldn't be needed for
   // the broker.
-  host_impl_.reset(new BrowserPpapiHostImpl(this, permissions,
-                                            std::string(), base::FilePath(),
-                                            base::FilePath(),
-                                            false /* in_process */,
-                                            false /* external_plugin */));
+  host_impl_ = std::make_unique<BrowserPpapiHostImpl>(
+      this, permissions, std::string(), base::FilePath(), base::FilePath(),
+      false /* in_process */, false /* external_plugin */);
 }
 
 bool PpapiPluginProcessHost::Init(const PepperPluginInfo& info) {
@@ -417,8 +416,8 @@ bool PpapiPluginProcessHost::Init(const PepperPluginInfo& info) {
 }
 
 void PpapiPluginProcessHost::RequestPluginChannel(Client* client) {
-  base::ProcessHandle process_handle;
-  int renderer_child_id;
+  base::ProcessHandle process_handle = base::kNullProcessHandle;
+  int renderer_child_id = base::kNullProcessId;
   client->GetPpapiChannelInfo(&process_handle, &renderer_child_id);
 
   base::ProcessId process_id = base::kNullProcessId;

content/browser/ppapi_plugin_process_host.h

@@ -15,6 +15,7 @@
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "base/process/process.h"
 #include "base/strings/string16.h"
 #include "content/browser/renderer_host/pepper/browser_ppapi_host_impl.h"
@@ -23,6 +24,7 @@
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "ipc/ipc_sender.h"
 #include "ppapi/shared_impl/ppapi_permissions.h"
+#include "url/origin.h"
 
 namespace content {
 class BrowserChildProcessHostImpl;
@@ -72,7 +74,9 @@ class PpapiPluginProcessHost : public BrowserChildProcessHostDelegate,
 
   static PpapiPluginProcessHost* CreatePluginHost(
       const PepperPluginInfo& info,
-      const base::FilePath& profile_data_directory);
+      const base::FilePath& profile_data_directory,
+      const base::Optional<url::Origin>& origin_lock);
+
   static PpapiPluginProcessHost* CreateBrokerHost(
       const PepperPluginInfo& info);
 
@@ -109,6 +113,9 @@ class PpapiPluginProcessHost : public BrowserChildProcessHostDelegate,
 
   BrowserPpapiHostImpl* host_impl() { return host_impl_.get(); }
   const BrowserChildProcessHostImpl* process() { return process_.get(); }
+  const base::Optional<url::Origin>& origin_lock() const {
+    return origin_lock_;
+  }
   const base::FilePath& plugin_path() const { return plugin_path_; }
   const base::FilePath& profile_data_directory() const {
     return profile_data_directory_;
@@ -122,7 +129,8 @@ class PpapiPluginProcessHost : public BrowserChildProcessHostDelegate,
   // Constructors for plugin and broker process hosts, respectively.
   // You must call Init before doing anything else.
   PpapiPluginProcessHost(const PepperPluginInfo& info,
-                         const base::FilePath& profile_data_directory);
+                         const base::FilePath& profile_data_directory,
+                         const base::Optional<url::Origin>& origin_lock);
   PpapiPluginProcessHost();
 
   // Actually launches the process with the given plugin info. Returns true
@@ -132,7 +140,6 @@ class PpapiPluginProcessHost : public BrowserChildProcessHostDelegate,
   void RequestPluginChannel(Client* client);
 
   void OnProcessLaunched() override;
-
   void OnProcessCrashed(int exit_code) override;
   bool OnMessageReceived(const IPC::Message& msg) override;
   void OnChannelConnected(int32_t peer_pid) override;
@@ -164,7 +171,11 @@ class PpapiPluginProcessHost : public BrowserChildProcessHostDelegate,
   base::FilePath plugin_path_;
 
   // Path to the top-level plugin data directory (differs based upon profile).
-  base::FilePath profile_data_directory_;
+  const base::FilePath profile_data_directory_;
+
+  // Specific origin to which this is bound, omitted to allow any origin to
+  // re-use the plugin host.
+  const base::Optional<url::Origin> origin_lock_;
 
   const bool is_broker_;
 

content/common/frame_messages.h

@@ -1397,8 +1397,9 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_PluginContentOriginAllowed,
 // plugin is hung.
 //
 // On error an empty string and null handles are returned.
-IPC_SYNC_MESSAGE_CONTROL1_3(FrameHostMsg_OpenChannelToPepperPlugin,
+IPC_SYNC_MESSAGE_CONTROL2_3(FrameHostMsg_OpenChannelToPepperPlugin,
                             base::FilePath /* path */,
+                            base::Optional<url::Origin>, /* origin_lock */
                             IPC::ChannelHandle /* handle to channel */,
                             base::ProcessId /* plugin_pid */,
                             int /* plugin_child_id */)

content/renderer/pepper/pepper_plugin_registry.cc

@@ -45,8 +45,11 @@ const PepperPluginInfo* PepperPluginRegistry::GetInfoForPlugin(
   return &plugin_list_.back();
 }
 
-PluginModule* PepperPluginRegistry::GetLiveModule(const base::FilePath& path) {
-  NonOwningModuleMap::iterator module_iter = live_modules_.find(path);
+PluginModule* PepperPluginRegistry::GetLiveModule(
+    const base::FilePath& path,
+    const base::Optional<url::Origin>& origin_lock) {
+  NonOwningModuleMap::iterator module_iter =
+      live_modules_.find({path, origin_lock});
   if (module_iter == live_modules_.end())
     return nullptr;
 
@@ -71,10 +74,12 @@ PluginModule* PepperPluginRegistry::GetLiveModule(const base::FilePath& path) {
   return nullptr;
 }
 
-void PepperPluginRegistry::AddLiveModule(const base::FilePath& path,
-                                         PluginModule* module) {
-  DCHECK(live_modules_.find(path) == live_modules_.end());
-  live_modules_[path] = module;
+void PepperPluginRegistry::AddLiveModule(
+    const base::FilePath& path,
+    const base::Optional<url::Origin>& origin_lock,
+    PluginModule* module) {
+  DCHECK(live_modules_.find({path, origin_lock}) == live_modules_.end());
+  live_modules_[{path, origin_lock}] = module;
 }
 
 void PepperPluginRegistry::PluginModuleDead(PluginModule* dead_module) {
@@ -122,7 +127,7 @@ void PepperPluginRegistry::Initialize() {
                          current.version,
                          current.path,
                          ppapi::PpapiPermissions(current.permissions));
-    AddLiveModule(current.path, module.get());
+    AddLiveModule(current.path, base::Optional<url::Origin>(), module.get());
     if (current.is_internal) {
       if (!module->InitAsInternalPlugin(current.internal_entry_points)) {
         DVLOG(1) << "Failed to load pepper module: " << current.path.value();

content/renderer/pepper/pepper_plugin_registry.h

@@ -10,7 +10,9 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/optional.h"
 #include "content/public/common/pepper_plugin_info.h"
+#include "url/origin.h"
 
 namespace content {
 class PluginModule;
@@ -34,15 +36,20 @@ class PepperPluginRegistry {
 
   // Returns an existing loaded module for the given path. It will search for
   // both preloaded in-process or currently active (non crashed) out-of-process
-  // plugins matching the given name. Returns NULL if the plugin hasn't been
-  // loaded.
-  PluginModule* GetLiveModule(const base::FilePath& path);
+  // plugins matching the given name (and origin if supplied). Returns NULL if
+  // the plugin hasn't been loaded.
+  PluginModule* GetLiveModule(const base::FilePath& path,
+                              const base::Optional<url::Origin>& origin_lock);
 
   // Notifies the registry that a new non-preloaded module has been created.
   // This is normally called for out-of-process plugins. Once this is called,
   // the module is available to be returned by GetModule(). The module will
   // automatically unregister itself by calling PluginModuleDestroyed().
-  void AddLiveModule(const base::FilePath& path, PluginModule* module);
+  // |origin_lock| is used to segregate plugins by origin, omitted if the
+  // plugin is to handle content from all origins.
+  void AddLiveModule(const base::FilePath& path,
+                     const base::Optional<url::Origin>& origin_lock,
+                     PluginModule* module);
 
   void PluginModuleDead(PluginModule* dead_module);
 
@@ -65,7 +72,9 @@ class PepperPluginRegistry {
   // non-crashed modules. If an out-of-process module crashes, it may
   // continue as long as there are WebKit references to it, but it will not
   // appear in this list.
-  typedef std::map<base::FilePath, PluginModule*> NonOwningModuleMap;
+  using NonOwningModuleMap =
+      std::map<std::pair<base::FilePath, base::Optional<url::Origin>>,
+               PluginModule*>;
   NonOwningModuleMap live_modules_;
 
   DISALLOW_COPY_AND_ASSIGN(PepperPluginRegistry);

content/renderer/pepper/plugin_module.cc

@@ -774,13 +774,14 @@ bool PluginModule::InitializeModule(
 scoped_refptr<PluginModule> PluginModule::Create(
     RenderFrameImpl* render_frame,
     const WebPluginInfo& webplugin_info,
+    const base::Optional<url::Origin>& origin_lock,
     bool* pepper_plugin_was_registered) {
   *pepper_plugin_was_registered = true;
 
   // See if a module has already been loaded for this plugin.
   base::FilePath path(webplugin_info.path);
   scoped_refptr<PluginModule> module =
-      PepperPluginRegistry::GetInstance()->GetLiveModule(path);
+      PepperPluginRegistry::GetInstance()->GetLiveModule(path, origin_lock);
   if (module.get()) {
     if (!module->renderer_ppapi_host()) {
       // If the module exists and no embedder state was associated with it,
@@ -809,7 +810,7 @@ scoped_refptr<PluginModule> PluginModule::Create(
   base::ProcessId peer_pid = 0;
   int plugin_child_id = 0;
   render_frame->Send(new FrameHostMsg_OpenChannelToPepperPlugin(
-      path, &channel_handle, &peer_pid, &plugin_child_id));
+      path, origin_lock, &channel_handle, &peer_pid, &plugin_child_id));
   if (!channel_handle.is_mojo_channel_handle()) {
     // Couldn't be initialized.
     return scoped_refptr<PluginModule>();
@@ -820,7 +821,8 @@ scoped_refptr<PluginModule> PluginModule::Create(
   // AddLiveModule must be called before any early returns since the
   // module's destructor will remove itself.
   module = new PluginModule(info->name, info->version, path, permissions);
-  PepperPluginRegistry::GetInstance()->AddLiveModule(path, module.get());
+  PepperPluginRegistry::GetInstance()->AddLiveModule(path, origin_lock,
+                                                     module.get());
 
   if (!module->CreateOutOfProcessModule(render_frame,
                                         path,

content/renderer/pepper/plugin_module.h

@@ -15,6 +15,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/native_library.h"
+#include "base/optional.h"
 #include "base/process/process.h"
 #include "content/common/content_export.h"
 #include "content/public/common/pepper_plugin_info.h"
@@ -23,6 +24,7 @@
 #include "ppapi/c/ppb_core.h"
 #include "ppapi/c/private/ppb_instance_private.h"
 #include "ppapi/shared_impl/ppapi_permissions.h"
+#include "url/origin.h"
 
 typedef void* NPIdentifier;
 
@@ -210,9 +212,11 @@ class CONTENT_EXPORT PluginModule : public base::RefCounted<PluginModule>,
   // the second is that the plugin failed to initialize. In this case,
   // |*pepper_plugin_was_registered| will be set to true and the caller should
   // not fall back on any other plugin types.
-  static scoped_refptr<PluginModule> Create(RenderFrameImpl* render_frame,
-                                            const WebPluginInfo& webplugin_info,
-                                            bool* pepper_plugin_was_registered);
+  static scoped_refptr<PluginModule> Create(
+      RenderFrameImpl* render_frame,
+      const WebPluginInfo& webplugin_info,
+      const base::Optional<url::Origin>& origin_lock,
+      bool* pepper_plugin_was_registered);
 
  private:
   friend class base::RefCounted<PluginModule>;

content/renderer/render_frame_impl.cc

@@ -2844,9 +2844,12 @@ blink::WebPlugin* RenderFrameImpl::CreatePlugin(
         this, delegate->GetWeakPtr());
   }
 
+  // TODO(tsepez): extract origin to lock from WebPluginParams url.
+  base::Optional<url::Origin> origin_lock;
+
   bool pepper_plugin_was_registered = false;
   scoped_refptr<PluginModule> pepper_module(PluginModule::Create(
-      this, info, &pepper_plugin_was_registered));
+      this, info, origin_lock, &pepper_plugin_was_registered));
   if (pepper_plugin_was_registered) {
     if (pepper_module.get()) {
       return new PepperWebPluginImpl(

content/test/BUILD.gn

@@ -1106,6 +1106,7 @@ test("content_browsertests") {
 
   if (enable_plugins) {
     sources += [
+      "../browser/plugin_service_impl_browsertest.cc",
       "../renderer/pepper/fake_pepper_plugin_instance.cc",
       "../renderer/pepper/fake_pepper_plugin_instance.h",
       "../renderer/pepper/mock_renderer_ppapi_host.cc",