blink: Provide the swap file for ParkableString discarding.

ParkableStrings can be written out to disk, through DiskDataAllocator
which multiplexes all writes onto a single file descriptor. The file is
provided by the browser process.

This adds the logic on the browser side to actually provide the file. It
is guarded by a (disabled by default) feature, and in any case for
incognito renderers.

This CL adds:
- A mojo interface to provide the file
- A feature to enable field trials
- Plumbing on the browser and renderer side.

Bug: 1029320
Change-Id: I6d1b4ce72561e6ac4dd74a1c4d2fd60a23c48995
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2160912
Commit-Queue: Benoit L <lizeb@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#761903}

content/browser/renderer_host/render_process_host_impl.cc

@@ -27,6 +27,7 @@
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file.h"
+#include "base/files/file_util.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/memory_pressure_monitor.h"
@@ -223,6 +224,7 @@
 #include "storage/browser/file_system/sandbox_file_system_backend.h"
 #include "third_party/blink/public/common/page/launching_process_state.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
+#include "third_party/blink/public/mojom/disk_allocator.mojom.h"
 #include "third_party/blink/public/public_buildflags.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/accessibility/accessibility_switches.h"
@@ -3610,6 +3612,8 @@ void RenderProcessHostImpl::OnChannelConnected(int32_t peer_pid) {
     // MemoryUsageMonitor in blink.
     ProvideStatusFileForRenderer();
 #endif
+
+    ProvideSwapFileForRenderer();
   }
 
 #if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
@@ -5062,4 +5066,38 @@ void RenderProcessHostImpl::ProvideStatusFileForRenderer() {
 }
 #endif
 
+void RenderProcessHostImpl::ProvideSwapFileForRenderer() {
+  if (!base::FeatureList::IsEnabled(features::kParkableStringsToDisk))
+    return;
+  mojo::Remote<blink::mojom::DiskAllocator> allocator;
+  BindReceiver(allocator.BindNewPipeAndPassReceiver());
+
+  // In Incognito, nothing should be written to disk. Providing an invalid file
+  // prevents the renderer from doing so.
+  if (GetBrowserContext()->IsOffTheRecord()) {
+    allocator->ProvideTemporaryFile(base::File());
+    return;
+  }
+
+  // File creation done on a background thread. The renderer side will behave
+  // correctly even if the file is provided later or never.
+  base::ThreadPool::PostTaskAndReplyWithResult(
+      FROM_HERE, {base::MayBlock()}, base::BindOnce([]() {
+        base::FilePath path;
+        CHECK(base::CreateTemporaryFile(&path));
+
+        int flags = base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_READ |
+                    base::File::FLAG_WRITE | base::File::FLAG_DELETE_ON_CLOSE;
+        auto file = base::File(base::FilePath(path), flags);
+        CHECK(file.IsValid());
+        return file;
+      }),
+      base::BindOnce(
+          [](mojo::Remote<blink::mojom::DiskAllocator> allocator,
+             base::File file) {
+            allocator->ProvideTemporaryFile(std::move(file));
+          },
+          std::move(allocator)));
+}
+
 }  // namespace content

content/browser/renderer_host/render_process_host_impl.h

@@ -953,6 +953,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void ProvideStatusFileForRenderer();
 #endif
 
+  // Gives a DELETE_ON_CLOSE file descriptor to the renderer, to use for
+  // swapping. See blink::DiskDataAllocator for uses.
+  void ProvideSwapFileForRenderer();
+
   mojo::OutgoingInvitation mojo_invitation_;
 
   size_t keep_alive_ref_count_;

content/public/common/content_features.cc

@@ -395,6 +395,10 @@ const base::Feature kOverscrollHistoryNavigation {
 #endif
 };
 
+// Whether ParkableStrings in blink can be written out to disk.
+const base::Feature kParkableStringsToDisk{"ParkableStringsToDisk",
+                                           base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Whether web apps can run periodic tasks upon network connectivity.
 const base::Feature kPeriodicBackgroundSync{"PeriodicBackgroundSync",
                                             base::FEATURE_DISABLED_BY_DEFAULT};

content/public/common/content_features.h

@@ -91,6 +91,7 @@ CONTENT_EXPORT extern const base::Feature kNotificationTriggers;
 CONTENT_EXPORT extern const base::Feature kOriginIsolationHeader;
 CONTENT_EXPORT extern const base::Feature kOriginPolicy;
 CONTENT_EXPORT extern const base::Feature kOverscrollHistoryNavigation;
+CONTENT_EXPORT extern const base::Feature kParkableStringsToDisk;
 CONTENT_EXPORT extern const base::Feature kPeriodicBackgroundSync;
 CONTENT_EXPORT extern const base::Feature kPepper3DImageChromium;
 CONTENT_EXPORT extern const base::Feature kPepperCrossOriginRedirectRestriction;

third_party/blink/public/mojom/BUILD.gn

@@ -44,6 +44,7 @@ mojom("mojom_platform") {
     "devtools/devtools_agent.mojom",
     "devtools/devtools_frontend.mojom",
     "devtools/inspector_issue.mojom",
+    "disk_allocator.mojom",
     "favicon/favicon_url.mojom",
     "feature_observer/feature_observer.mojom",
     "feature_policy/document_policy_feature.mojom",

third_party/blink/public/mojom/disk_allocator.mojom

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module blink.mojom;
+
+import "mojo/public/mojom/base/file.mojom";
+
+// The interface to provide a temporary file the renderer can read/write from/to.
+interface DiskAllocator {
+
+  // Provides a writable |file| to the renderer from the browser process.
+  //
+  // The renderer-side implementation is DiskDataAllocator, and this must be
+  // called at most once per renderer, from RenderProcessHostImpl when a new
+  // renderer starts.
+  //
+  // The file must be deleted when closing (using DELETE_ON_CLOSE), and
+  // exclusively owned by the renderer. It may be invalid.
+  ProvideTemporaryFile(mojo_base.mojom.File file);
+};

third_party/blink/renderer/controller/blink_initializer.cc

@@ -52,6 +52,7 @@
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/platform/bindings/microtask.h"
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
+#include "third_party/blink/renderer/platform/disk_data_allocator.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/histogram.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
@@ -201,6 +202,10 @@ void BlinkInitializer::RegisterInterfaces(mojo::BinderMap& binders) {
   binders.Add(ConvertToBaseRepeatingCallback(
                   CrossThreadBindRepeating(&BlinkLeakDetector::Create)),
               main_thread->GetTaskRunner());
+
+  binders.Add(ConvertToBaseRepeatingCallback(
+                  CrossThreadBindRepeating(&DiskDataAllocator::Bind)),
+              main_thread->GetTaskRunner());
 }
 
 void BlinkInitializer::InitLocalFrame(LocalFrame& frame) const {

third_party/blink/renderer/platform/disk_data_allocator.cc

@@ -200,4 +200,11 @@ DiskDataAllocator& DiskDataAllocator::Instance() {
   return instance;
 }
 
+// static
+void DiskDataAllocator::Bind(
+    mojo::PendingReceiver<mojom::blink::DiskAllocator> receiver) {
+  DCHECK(!Instance().receiver_.is_bound());
+  Instance().receiver_.Bind(std::move(receiver));
+}
+
 }  // namespace blink

third_party/blink/renderer/platform/disk_data_allocator.h

@@ -11,6 +11,7 @@
 #include "base/files/file.h"
 #include "base/synchronization/lock.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "third_party/blink/public/mojom/disk_allocator.mojom-blink.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
 #include "third_party/blink/renderer/platform/wtf/threading.h"
 #include "third_party/blink/renderer/platform/wtf/threading_primitives.h"
@@ -29,7 +30,7 @@ namespace blink {
 // - Writes can be done from any thread.
 // - public methods are thread-safe, and unless otherwise noted, can be called
 //   from any thread.
-class PLATFORM_EXPORT DiskDataAllocator {
+class PLATFORM_EXPORT DiskDataAllocator : public mojom::blink::DiskAllocator {
  public:
   class Metadata {
    public:
@@ -50,7 +51,7 @@ class PLATFORM_EXPORT DiskDataAllocator {
   };
 
   // Must be called on the main thread.
-  void ProvideTemporaryFile(::base::File file);
+  void ProvideTemporaryFile(::base::File file) override;
 
   // Whether writes may succeed. This is not a guarantee. However, when this
   // returns false, writes will fail.
@@ -71,8 +72,9 @@ class PLATFORM_EXPORT DiskDataAllocator {
   // Discards existing data pointed at by |metadata|.
   void Discard(std::unique_ptr<Metadata> metadata);
 
-  virtual ~DiskDataAllocator();
+  ~DiskDataAllocator() override;
   static DiskDataAllocator& Instance();
+  static void Bind(mojo::PendingReceiver<mojom::blink::DiskAllocator> receiver);
 
  protected:
   // Protected methods for testing.
@@ -89,6 +91,7 @@ class PLATFORM_EXPORT DiskDataAllocator {
   // CHECK()s that the read is successful.
   virtual void DoRead(int64_t offset, char* data, int size);
 
+  mojo::Receiver<mojom::blink::DiskAllocator> receiver_{this};
   base::File file_;  // May be invalid.
 
  protected:  // For testing.