Take the process limit into account in GetMaxRendererProcessCount() on Linux.

On Linux, given sufficient RAM, GetMaxRendererProcessCount() can now
return a value as high as (RLIMIT_NPROC / 2), instead of being capped to
a hard-coded maximum. This lets the browser start more processes and
have more process isolation between renderers if the environment can
support it.

This also makes the browser behave better when running in an environment
that is constrained by the process limit.

BUG=104689

Change-Id: I2b249bc4b1e1c2e52579cf6fd603798f3e028249
Reviewed-on: https://chromium-review.googlesource.com/c/1088242
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#626313}

content/browser/renderer_host/render_process_host_impl.cc

@@ -232,6 +232,11 @@
 #include "content/browser/compositor/image_transport_factory.h"
 #endif
 
+#if defined(OS_LINUX)
+#include <sys/resource.h>
+#include <sys/time.h>
+#endif
+
 #if defined(OS_MACOSX)
 #include "content/browser/mach_broker_mac.h"
 #endif
@@ -1314,6 +1319,29 @@ void AddCorbExceptionForPluginOnIOThread(int process_id) {
       base::BindOnce(&AddCorbExceptionForPluginOnUIThread, process_id));
 }
 
+#if !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
+static constexpr size_t kUnknownPlatformProcessLimit = 0;
+
+// Returns the process limit from the system. Use |kUnknownPlatformProcessLimit|
+// to indicate failure and std::numeric_limits<size_t>::max() to indicate
+// unlimited.
+size_t GetPlatformProcessLimit() {
+#if defined(OS_LINUX)
+  struct rlimit limit;
+  static_assert(sizeof(size_t) >= sizeof(limit.rlim_cur),
+                "rlim_t does not fit in size_t");
+
+  if (getrlimit(RLIMIT_NPROC, &limit) != 0)
+    return kUnknownPlatformProcessLimit;
+  return limit.rlim_cur != RLIM_INFINITY ? limit.rlim_cur
+                                         : std::numeric_limits<size_t>::max();
+#else
+  // TODO(https://crbug.com/104689): Implement on other platforms.
+  return kUnknownPlatformProcessLimit;
+#endif  // defined(OS_LINUX)
+}
+#endif  // !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
+
 }  // namespace
 
 // Held by the RPH and used to control an (unowned) ConnectionFilterImpl from
@@ -1419,8 +1447,15 @@ RenderProcessHostImpl::GetInProcessRendererThreadTaskRunnerForTesting() {
 #if !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
 // static
 size_t RenderProcessHostImpl::GetPlatformMaxRendererProcessCount() {
+  // Set the limit to half of the system limit to leave room for other programs.
+  size_t limit = GetPlatformProcessLimit() / 2;
+
+  // If the system limit is unavailable, use a fallback value instead.
+  if (limit == kUnknownPlatformProcessLimit) {
     static constexpr size_t kMaxRendererProcessCount = 82;
-  return kMaxRendererProcessCount;
+    limit = kMaxRendererProcessCount;
+  }
+  return limit;
 }
 #endif
 
@@ -1475,9 +1510,12 @@ size_t RenderProcessHost::GetMaxRendererProcessCount() {
     max_count /= kEstimatedWebContentsMemoryUsage;
 
     static constexpr size_t kMinRendererProcessCount = 3;
-    max_count = base::ClampToRange(
-        max_count, kMinRendererProcessCount,
-        RenderProcessHostImpl::GetPlatformMaxRendererProcessCount());
+    static const size_t kMaxRendererProcessCount =
+        RenderProcessHostImpl::GetPlatformMaxRendererProcessCount();
+    DCHECK_LE(kMinRendererProcessCount, kMaxRendererProcessCount);
+
+    max_count = base::ClampToRange(max_count, kMinRendererProcessCount,
+                                   kMaxRendererProcessCount);
   }
   return max_count;
 #endif