-
Notifications
You must be signed in to change notification settings - Fork 6.6k
/
site_instance_impl.cc
1511 lines (1303 loc) · 61.6 KB
/
site_instance_impl.cc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// Copyright 2012 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "content/browser/site_instance_impl.h"
#include <string>
#include <tuple>
#include "base/containers/contains.h"
#include "base/debug/crash_logging.h"
#include "base/debug/dump_without_crashing.h"
#include "base/lazy_instance.h"
#include "base/trace_event/typed_macros.h"
#include "content/browser/bad_message.h"
#include "content/browser/child_process_security_policy_impl.h"
#include "content/browser/isolated_origin_util.h"
#include "content/browser/isolation_context.h"
#include "content/browser/process_lock.h"
#include "content/browser/renderer_host/render_process_host_impl.h"
#include "content/browser/site_instance_group.h"
#include "content/browser/storage_partition_impl.h"
#include "content/public/browser/browser_or_resource_context.h"
#include "content/public/browser/content_browser_client.h"
#include "content/public/browser/site_isolation_policy.h"
#include "content/public/browser/web_ui_controller_factory.h"
#include "content/public/common/content_client.h"
#include "content/public/common/content_features.h"
#include "content/public/common/url_constants.h"
#include "content/public/common/url_utils.h"
#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
#include "third_party/blink/public/common/chrome_debug_urls.h"
#include "third_party/blink/public/common/features.h"
#include "third_party/perfetto/include/perfetto/tracing/traced_value.h"
#include "url/origin.h"
namespace content {
namespace {
// Constant used to mark two call sites that must always agree on whether
// the default SiteInstance is allowed.
constexpr bool kCreateForURLAllowsDefaultSiteInstance = true;
// Asks the embedder whether effective URLs should be used when determining if
// |dest_url| should end up in |site_instance|.
// This is used to keep same-site scripting working for hosted apps.
bool ShouldCompareEffectiveURLs(BrowserContext* browser_context,
SiteInstanceImpl* site_instance,
bool for_outermost_main_frame,
const GURL& dest_url) {
return site_instance->IsDefaultSiteInstance() ||
GetContentClient()
->browser()
->ShouldCompareEffectiveURLsForSiteInstanceSelection(
browser_context, site_instance, for_outermost_main_frame,
site_instance->original_url(), dest_url);
}
SiteInstanceId::Generator g_site_instance_id_generator;
} // namespace
// static
const GURL& SiteInstanceImpl::GetDefaultSiteURL() {
struct DefaultSiteURL {
const GURL url = GURL("http://unisolated.invalid");
};
static base::LazyInstance<DefaultSiteURL>::Leaky default_site_url =
LAZY_INSTANCE_INITIALIZER;
return default_site_url.Get().url;
}
class SiteInstanceImpl::DefaultSiteInstanceState {
public:
void AddSiteInfo(const SiteInfo& site_info) {
default_site_url_set_.insert(site_info.site_url());
}
bool ContainsSite(const GURL& site_url) {
return base::Contains(default_site_url_set_, site_url);
}
private:
// Keeps track of the site URLs that have been mapped to the default
// SiteInstance.
// TODO(wjmaclean): Revise this to store SiteInfos instead of GURLs.
std::set<GURL> default_site_url_set_;
};
SiteInstanceImpl::SiteInstanceImpl(BrowsingInstance* browsing_instance)
: id_(g_site_instance_id_generator.GenerateNextId()),
browsing_instance_(browsing_instance),
can_associate_with_spare_process_(true),
site_info_(browsing_instance->isolation_context()
.browser_or_resource_context()
.ToBrowserContext()),
has_site_(false),
process_reuse_policy_(ProcessReusePolicy::DEFAULT),
is_for_service_worker_(false),
process_assignment_(SiteInstanceProcessAssignment::UNKNOWN) {
DCHECK(browsing_instance);
}
SiteInstanceImpl::~SiteInstanceImpl() {
if (destruction_callback_for_testing_) {
std::move(destruction_callback_for_testing_).Run();
}
// Now that no one is referencing us, we can safely remove ourselves from
// the BrowsingInstance. Any future visits to a page from this site
// (within the same BrowsingInstance) can safely create a new SiteInstance.
if (has_site_)
browsing_instance_->UnregisterSiteInstance(this);
if (has_group()) {
group()->RemoveSiteInstance(this);
ResetSiteInstanceGroup();
}
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::Create(
BrowserContext* browser_context) {
DCHECK(browser_context);
return base::WrapRefCounted(new SiteInstanceImpl(new BrowsingInstance(
browser_context, WebExposedIsolationInfo::CreateNonIsolated(),
/*is_guest=*/false, /*is_fenced=*/false,
/*coop_related_group=*/nullptr, /*common_coop_origin=*/absl::nullopt)));
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForUrlInfo(
BrowserContext* browser_context,
const UrlInfo& url_info,
bool is_guest,
bool is_fenced) {
DCHECK(url_info.is_sandboxed ||
url_info.unique_sandbox_id == UrlInfo::kInvalidUniqueSandboxId);
CHECK(!is_guest || url_info.storage_partition_config.has_value());
DCHECK(browser_context);
// This will create a new SiteInstance and BrowsingInstance.
scoped_refptr<BrowsingInstance> instance(
new BrowsingInstance(browser_context,
url_info.web_exposed_isolation_info.value_or(
WebExposedIsolationInfo::CreateNonIsolated()),
is_guest, is_fenced, /*coop_related_group=*/nullptr,
url_info.common_coop_origin));
// Note: The |allow_default_instance| value used here MUST match the value
// used in DoesSiteForURLMatch().
return instance->GetSiteInstanceForURL(
url_info, kCreateForURLAllowsDefaultSiteInstance);
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForServiceWorker(
BrowserContext* browser_context,
const UrlInfo& url_info,
bool can_reuse_process,
bool is_guest,
bool is_fenced) {
DCHECK(!url_info.url.SchemeIs(kChromeErrorScheme));
DCHECK(url_info.storage_partition_config.has_value());
// This will create a new SiteInstance and BrowsingInstance.
// TODO(https://crbug.com/1221127): Verify that having different common COOP
// origins does not hinder the ability of a ServiceWorker to share its page's
// process.
scoped_refptr<BrowsingInstance> instance(
new BrowsingInstance(browser_context,
url_info.web_exposed_isolation_info.value_or(
WebExposedIsolationInfo::CreateNonIsolated()),
is_guest, is_fenced, /*coop_related_group=*/nullptr,
url_info.common_coop_origin));
// We do NOT want to allow the default site instance here because workers
// need to be kept separate from other sites.
scoped_refptr<SiteInstanceImpl> site_instance =
instance->GetSiteInstanceForURL(url_info,
/* allow_default_instance */ false);
DCHECK(!site_instance->GetSiteInfo().is_error_page());
DCHECK_EQ(site_instance->IsGuest(), is_guest);
site_instance->is_for_service_worker_ = true;
// Attempt to reuse a renderer process if possible. Note that in the
// <webview> case, process reuse isn't currently supported and a new
// process will always be created (https://crbug.com/752667).
DCHECK(site_instance->process_reuse_policy() ==
SiteInstanceImpl::ProcessReusePolicy::DEFAULT ||
site_instance->process_reuse_policy() ==
SiteInstanceImpl::ProcessReusePolicy::PROCESS_PER_SITE);
if (can_reuse_process) {
site_instance->set_process_reuse_policy(
SiteInstanceImpl::ProcessReusePolicy::REUSE_PENDING_OR_COMMITTED_SITE);
}
return site_instance;
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForGuest(
BrowserContext* browser_context,
const StoragePartitionConfig& partition_config) {
DCHECK(browser_context);
DCHECK(!partition_config.is_default());
auto guest_site_info =
SiteInfo::CreateForGuest(browser_context, partition_config);
scoped_refptr<SiteInstanceImpl> site_instance =
base::WrapRefCounted(new SiteInstanceImpl(new BrowsingInstance(
browser_context, guest_site_info.web_exposed_isolation_info(),
/*is_guest=*/true,
/*is_fenced=*/false, /*coop_related_group=*/nullptr,
/*common_coop_origin=*/absl::nullopt)));
site_instance->SetSiteInfoInternal(guest_site_info);
return site_instance;
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForFencedFrame(
SiteInstanceImpl* embedder_site_instance) {
DCHECK(embedder_site_instance);
BrowserContext* browser_context = embedder_site_instance->GetBrowserContext();
bool should_isolate_fenced_frames =
SiteIsolationPolicy::IsProcessIsolationForFencedFramesEnabled();
scoped_refptr<SiteInstanceImpl> site_instance =
base::WrapRefCounted(new SiteInstanceImpl(new BrowsingInstance(
browser_context, embedder_site_instance->GetWebExposedIsolationInfo(),
embedder_site_instance->IsGuest(),
/*is_fenced=*/should_isolate_fenced_frames,
/*coop_related_group=*/nullptr,
/*common_coop_origin=*/absl::nullopt)));
// Give the new fenced frame SiteInstance the same site url as its embedder's
// SiteInstance to allow it to reuse its embedder's process. We avoid doing
// this in the default SiteInstance case as the url will be invalid; process
// reuse will still happen below though, as the embedder's SiteInstance's
// process will not be locked to any site.
// Note: Even when process isolation for fenced frames is enabled, we will
// still be able to reuse the embedder's process below, because we set its
// SiteInfo to be the embedder's SiteInfo, and |is_fenced| will be false. The
// process will change after the first navigation (the new SiteInstance will
// have a SiteInfo with is_fenced set to true).
if (!embedder_site_instance->IsDefaultSiteInstance()) {
site_instance->SetSite(embedder_site_instance->GetSiteInfo());
} else if (embedder_site_instance->IsGuest()) {
// For guests, in the case where the embedder is not a default SiteInstance,
// we reuse the embedder's SiteInfo above. When the embedder is
// a default SiteInstance, we explicitly create a SiteInfo through
// CreateForGuest.
// TODO(crbug.com/1340662): When we support fenced frame process isolation
// with partial or no site isolation modes, we will be able to reach this
// code path and will need to also set is_fenced for the SiteInfo created
// below.
DCHECK(!should_isolate_fenced_frames);
site_instance->SetSite(SiteInfo::CreateForGuest(
browser_context, embedder_site_instance->GetStoragePartitionConfig()));
}
DCHECK_EQ(embedder_site_instance->IsGuest(), site_instance->IsGuest());
site_instance->ReuseExistingProcessIfPossible(
embedder_site_instance->GetProcess());
return site_instance;
}
// static
scoped_refptr<SiteInstanceImpl>
SiteInstanceImpl::CreateReusableInstanceForTesting(
BrowserContext* browser_context,
const GURL& url) {
DCHECK(browser_context);
// This will create a new SiteInstance and BrowsingInstance.
scoped_refptr<BrowsingInstance> instance(new BrowsingInstance(
browser_context, WebExposedIsolationInfo::CreateNonIsolated(),
/*is_guest=*/false, /*is_fenced=*/false,
/*coop_related_group=*/nullptr,
/*common_coop_origin=*/absl::nullopt));
auto site_instance = instance->GetSiteInstanceForURL(
UrlInfo(UrlInfoInit(url)), /* allow_default_instance */ false);
site_instance->set_process_reuse_policy(
SiteInstanceImpl::ProcessReusePolicy::REUSE_PENDING_OR_COMMITTED_SITE);
return site_instance;
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForTesting(
BrowserContext* browser_context,
const GURL& url) {
DCHECK(browser_context);
return SiteInstanceImpl::CreateForUrlInfo(browser_context,
UrlInfo::CreateForTesting(url),
/*is_guest=*/false,
/*is_fenced=*/false);
}
// static
bool SiteInstanceImpl::ShouldAssignSiteForUrlInfo(const UrlInfo& url_info) {
// Only empty document schemes can leave SiteInstances unassigned.
if (!base::Contains(url::GetEmptyDocumentSchemes(), url_info.url.scheme())) {
return true;
}
if (url_info.url.SchemeIs(url::kAboutScheme)) {
// TODO(alexmos): Currently, we force about: URLs that are not about:blank
// to assign a site. This has been the legacy behavior, and it's unclear
// whether this matters one way or another, so we can consider changing
// this if there's a good motivation.
if (!url_info.url.IsAboutBlank()) {
return true;
}
// Check if the UrlInfo carries an inherited origin for about:blank, such
// as with a renderer-initiated about:blank navigation where the origin is
// taken from the navigation's initiator. In such cases, the SiteInstance
// assignment must also honor a valid initiator origin (which could require
// a dedicated process), and hence it cannot be left unassigned.
//
// Note that starting an about:blank navigation from an opaque unique
// origin is safe to leave unassigned. Some Android tests currently rely on
// that behavior.
if (url_info.origin.has_value() &&
url_info.origin->GetTupleOrPrecursorTupleIfOpaque().IsValid()) {
return true;
}
// Otherwise, it is ok for about:blank to not "use up" a new SiteInstance.
// The SiteInstance can still be used for a normal web site. For example,
// this is used for newly-created tabs.
return false;
}
// Do not assign a site for other empty document schemes. One notable use of
// this is for Android's native NTP, which uses the chrome-native: scheme.
return false;
}
SiteInstanceId SiteInstanceImpl::GetId() {
return id_;
}
BrowsingInstanceId SiteInstanceImpl::GetBrowsingInstanceId() {
return browsing_instance_->isolation_context().browsing_instance_id();
}
const IsolationContext& SiteInstanceImpl::GetIsolationContext() {
return browsing_instance_->isolation_context();
}
RenderProcessHost* SiteInstanceImpl::GetSiteInstanceGroupProcessIfAvailable() {
return browsing_instance_->site_instance_group_manager()
.GetExistingGroupProcess(this);
}
bool SiteInstanceImpl::IsDefaultSiteInstance() const {
return default_site_instance_state_ != nullptr;
}
void SiteInstanceImpl::AddSiteInfoToDefault(const SiteInfo& site_info) {
DCHECK(IsDefaultSiteInstance());
default_site_instance_state_->AddSiteInfo(site_info);
}
bool SiteInstanceImpl::IsSiteInDefaultSiteInstance(const GURL& site_url) const {
DCHECK(IsDefaultSiteInstance());
return default_site_instance_state_->ContainsSite(site_url);
}
// static
BrowsingInstanceId SiteInstanceImpl::NextBrowsingInstanceId() {
return BrowsingInstance::NextBrowsingInstanceId();
}
bool SiteInstanceImpl::HasProcess() {
if (has_group())
return true;
// If we would use process-per-site for this site, also check if there is an
// existing process that we would use if GetProcess() were called.
if (ShouldUseProcessPerSite() &&
RenderProcessHostImpl::GetSoleProcessHostForSite(GetIsolationContext(),
site_info_)) {
return true;
}
return false;
}
RenderProcessHost* SiteInstanceImpl::GetProcess() {
// Create a new SiteInstanceGroup and RenderProcessHost is there isn't one.
// All SiteInstances within a SiteInstanceGroup share a process and
// AgentSchedulingGroupHost. A group must have a process. If the process gets
// destructed, `site_instance_group_` will get cleared, and another one with a
// new process will be assigned the next time GetProcess() gets called.
if (!has_group()) {
// Check if the ProcessReusePolicy should be updated.
if (ShouldUseProcessPerSite()) {
process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
} else if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE) {
process_reuse_policy_ = ProcessReusePolicy::DEFAULT;
}
SetProcessInternal(
RenderProcessHostImpl::GetProcessHostForSiteInstance(this));
}
DCHECK(site_instance_group_);
return site_instance_group_->process();
}
bool SiteInstanceImpl::ShouldUseProcessPerSite() const {
BrowserContext* browser_context = browsing_instance_->GetBrowserContext();
return has_site_ && site_info_.ShouldUseProcessPerSite(browser_context);
}
void SiteInstanceImpl::ReuseExistingProcessIfPossible(
RenderProcessHost* existing_process) {
if (HasProcess())
return;
// We should not reuse `existing_process` if the destination uses
// process-per-site. Note that this includes the case where the process for
// the site is not there yet (so we're going to create a new process). Note
// also that this does not apply for the reverse case: if the existing process
// is used for a process-per-site site, it is ok to reuse this for the new
// page (regardless of the site).
if (ShouldUseProcessPerSite())
return;
// Do not reuse the process if it's not suitable for this SiteInstance. For
// example, this won't allow reusing a process if it's locked to a site that's
// different from this SiteInstance's site.
if (!RenderProcessHostImpl::MayReuseAndIsSuitable(existing_process, this)) {
return;
}
// TODO(crbug.com/1055779): Don't try to reuse process if either of the
// SiteInstances are cross-origin isolated (uses COOP/COEP).
SetProcessInternal(existing_process);
}
void SiteInstanceImpl::SetProcessInternal(RenderProcessHost* process) {
if (!site_instance_group_) {
site_instance_group_ =
browsing_instance_->site_instance_group_manager()
.GetOrCreateGroupForNewSiteInstance(this, process);
}
LockProcessIfNeeded();
// If we are using process-per-site, we need to register this process
// for the current site so that we can find it again. (If no site is set
// at this time, we will register it in SetSite().)
if (process_reuse_policy_ == ProcessReusePolicy::PROCESS_PER_SITE &&
has_site_) {
RenderProcessHostImpl::RegisterSoleProcessHostForSite(
site_instance_group_->process(), this);
}
TRACE_EVENT2("navigation", "SiteInstanceImpl::SetProcessInternal", "site id",
id_.value(), "process id",
site_instance_group_->process()->GetID());
GetContentClient()->browser()->SiteInstanceGotProcess(this);
// Notify SiteInstanceGroupManager that the process was set on this
// SiteInstance. This must be called after LockProcessIfNeeded() because
// the SiteInstanceGroupManager does suitability checks that use the lock.
browsing_instance_->site_instance_group_manager().OnProcessSet(this);
}
bool SiteInstanceImpl::CanAssociateWithSpareProcess() {
return can_associate_with_spare_process_;
}
void SiteInstanceImpl::PreventAssociationWithSpareProcess() {
can_associate_with_spare_process_ = false;
}
void SiteInstanceImpl::SetSite(const UrlInfo& url_info) {
const GURL& url = url_info.url;
// TODO(creis): Consider calling ShouldAssignSiteForURL internally, rather
// than before multiple call sites. See https://crbug.com/949220.
TRACE_EVENT2("navigation", "SiteInstanceImpl::SetSite", "site id",
id_.value(), "url", url.possibly_invalid_spec());
// A SiteInstance's site should not change.
// TODO(creis): When following links or script navigations, we can currently
// render pages from other sites in this SiteInstance. This will eventually
// be fixed, but until then, we should still not set the site of a
// SiteInstance more than once.
DCHECK(!has_site_);
original_url_ = url;
// Convert |url| into an appropriate SiteInfo that can be passed to
// SetSiteInfoInternal(). We must do this transformation for any arbitrary
// URL we get from a user, a navigation, or script.
SetSiteInfoInternal(browsing_instance_->GetSiteInfoForURL(
url_info, /* allow_default_instance */ false));
}
void SiteInstanceImpl::SetSite(const SiteInfo& site_info) {
TRACE_EVENT2("navigation", "SiteInstanceImpl::SetSite", "site id",
id_.value(), "siteinfo", site_info.GetDebugString());
DCHECK(!has_site_);
SetSiteInfoInternal(site_info);
}
void SiteInstanceImpl::SetSiteInfoToDefault(
const StoragePartitionConfig& storage_partition_config) {
TRACE_EVENT1("navigation", "SiteInstanceImpl::SetSiteInfoToDefault",
"site id", id_.value());
DCHECK(!has_site_);
default_site_instance_state_ = std::make_unique<DefaultSiteInstanceState>();
original_url_ = GetDefaultSiteURL();
SetSiteInfoInternal(SiteInfo::CreateForDefaultSiteInstance(
GetIsolationContext(), storage_partition_config,
browsing_instance_->web_exposed_isolation_info()));
}
void SiteInstanceImpl::SetSiteInfoInternal(const SiteInfo& site_info) {
// TODO(acolwell): Add logic to validate |site_url| and |lock_url| are valid.
DCHECK(!has_site_);
CHECK_EQ(site_info.web_exposed_isolation_info(),
browsing_instance_->web_exposed_isolation_info());
if (verify_storage_partition_info_) {
auto old_partition_config = site_info_.storage_partition_config();
auto new_partition_config = site_info.storage_partition_config();
CHECK_EQ(old_partition_config, new_partition_config);
}
// Remember that this SiteInstance has been used to load a URL, even if the
// URL is invalid.
has_site_ = true;
site_info_ = site_info;
// Now that we have a site, register it with the BrowsingInstance. This
// ensures that we won't create another SiteInstance for this site within
// the same BrowsingInstance, because all same-site pages within a
// BrowsingInstance can script each other.
browsing_instance_->RegisterSiteInstance(this);
if (site_info_.requires_origin_keyed_process() &&
!site_info_.requires_origin_keyed_process_by_default()) {
// Track this origin's isolation in the current BrowsingInstance, if it has
// received an origin-keyed process due to an explicit opt-in. This is
// needed to consistently isolate future navigations to this origin in this
// BrowsingInstance, even if its opt-in status changes later.
ChildProcessSecurityPolicyImpl* policy =
ChildProcessSecurityPolicyImpl::GetInstance();
url::Origin origin(url::Origin::Create(site_info_.process_lock_url()));
// This is one of two places that origins can be marked as opted-in, the
// other is
// NavigationRequest::AddSameProcessOriginAgentClusterStateIfNecessary().
// This site handles the case where OAC isolation gets a separate process.
// In future, when SiteInstance Groups are complete, this may revert to
// being the only call site.
policy->AddOriginIsolationStateForBrowsingInstance(
browsing_instance_->isolation_context(), origin,
true /* is_origin_agent_cluster */,
true /* requires_origin_keyed_process */);
}
if (site_info_.does_site_request_dedicated_process_for_coop()) {
// If there was a request to process-isolate `site_info_` from COOP
// headers, notify ChildProcessSecurityPolicy about the new isolated origin
// in the current BrowsingInstance. Note that we must convert the origin
// to a site to avoid breaking document.domain. Typically, the process
// lock URL would already correspond to a site (since we isolate sites, not
// origins, by default), but this isn't always the case. For example, this
// SiteInstance could be isolated with the origin granularity due to
// Origin-Agent-Cluster (see site_info_.requires_origin_keyed_process()
// above).
url::Origin origin(url::Origin::Create(site_info_.process_lock_url()));
GURL site(SiteInfo::GetSiteForOrigin(origin));
ChildProcessSecurityPolicyImpl* policy =
ChildProcessSecurityPolicyImpl::GetInstance();
policy->AddCoopIsolatedOriginForBrowsingInstance(
browsing_instance_->isolation_context(), url::Origin::Create(site),
ChildProcessSecurityPolicy::IsolatedOriginSource::WEB_TRIGGERED);
}
// Update the process reuse policy based on the site.
bool should_use_process_per_site = ShouldUseProcessPerSite();
if (should_use_process_per_site)
process_reuse_policy_ = ProcessReusePolicy::PROCESS_PER_SITE;
if (has_group()) {
LockProcessIfNeeded();
// Ensure the process is registered for this site if necessary.
if (should_use_process_per_site) {
RenderProcessHostImpl::RegisterSoleProcessHostForSite(
site_instance_group_->process(), this);
}
}
// Notify SiteInstanceGroupManager that the SiteInfo was set on this
// SiteInstance. This must be called after LockProcessIfNeeded() because
// the SiteInstanceGroupManager does suitability checks that use the lock.
browsing_instance_->site_instance_group_manager().OnSiteInfoSet(this,
has_group());
}
void SiteInstanceImpl::ConvertToDefaultOrSetSite(const UrlInfo& url_info) {
DCHECK(!has_site_);
if (!browsing_instance_->HasDefaultSiteInstance()) {
// We want to set a SiteInfo in this SiteInstance, from information in a
// UrlInfo. The WebExposedIsolationInfo must be compatible for this function
// to not violate WebExposedIsolationInfo isolation invariant within a
// BrowsingInstance.
DCHECK(WebExposedIsolationInfo::AreCompatible(
url_info.web_exposed_isolation_info, GetWebExposedIsolationInfo()));
// If |url_info| has a null WebExposedIsolationInfo, it is compatible with
// any isolation state. We reuse the isolation state of the browsing
// instance for the SiteInfo, to preserve the invariant.
UrlInfo updated_url_info = url_info;
updated_url_info.web_exposed_isolation_info = GetWebExposedIsolationInfo();
const SiteInfo site_info =
SiteInfo::Create(GetIsolationContext(), updated_url_info);
if (CanBePlacedInDefaultSiteInstance(GetIsolationContext(),
updated_url_info.url, site_info)) {
SetSiteInfoToDefault(site_info.storage_partition_config());
AddSiteInfoToDefault(site_info);
DCHECK(browsing_instance_->HasDefaultSiteInstance());
return;
}
}
SetSite(url_info);
}
SiteInstanceProcessAssignment
SiteInstanceImpl::GetLastProcessAssignmentOutcome() {
return process_assignment_;
}
const GURL& SiteInstanceImpl::GetSiteURL() {
return site_info_.site_url();
}
const SiteInfo& SiteInstanceImpl::GetSiteInfo() {
return site_info_;
}
SiteInfo SiteInstanceImpl::DeriveSiteInfo(
const UrlInfo& url_info,
bool is_related,
bool disregard_web_exposed_isolation_info) {
if (is_related) {
return browsing_instance_->GetSiteInfoForURL(
url_info, /* allow_default_instance */ true);
}
// If we care about WebExposedIsolationInfo, verify that the passed in
// WebExposedIsolationInfo is compatible with the internal state. If they
// don't, the semantics of the function would be unclear.
if (!disregard_web_exposed_isolation_info) {
DCHECK(WebExposedIsolationInfo::AreCompatible(
url_info.web_exposed_isolation_info, GetWebExposedIsolationInfo()));
}
// At this stage, we either have two values of WebExposedIsolationInfo that
// can be resolved into one, for example when UrlInfo has an empty
// WebExposedIsolationInfo and it is matchable with any isolation state. Or we
// are trying to compute other state, regardless of what the passed in
// WebExposedIsolationInfos are. In both cases, we simply use the
// SiteInstance's value.
UrlInfo overridden_url_info = url_info;
overridden_url_info.web_exposed_isolation_info = GetWebExposedIsolationInfo();
// New SiteInfos created for site-isolated guests should keep the same
// StoragePartition.
if (IsGuest()) {
overridden_url_info.storage_partition_config =
GetSiteInfo().storage_partition_config();
}
return SiteInfo::Create(GetIsolationContext(), overridden_url_info);
}
bool SiteInstanceImpl::HasSite() const {
return has_site_;
}
bool SiteInstanceImpl::HasRelatedSiteInstance(const SiteInfo& site_info) {
return browsing_instance_->HasSiteInstance(site_info);
}
scoped_refptr<SiteInstance> SiteInstanceImpl::GetRelatedSiteInstance(
const GURL& url) {
return GetRelatedSiteInstanceImpl(UrlInfo(UrlInfoInit(url)));
}
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::GetRelatedSiteInstanceImpl(
const UrlInfo& url_info) {
return browsing_instance_->GetSiteInstanceForURL(
url_info, /* allow_default_instance */ true);
}
scoped_refptr<SiteInstanceImpl>
SiteInstanceImpl::GetCoopRelatedSiteInstanceImpl(const UrlInfo& url_info) {
return browsing_instance_->GetCoopRelatedSiteInstanceForURL(
url_info, /* allow_default_instance */ true);
}
AgentSchedulingGroupHost& SiteInstanceImpl::GetOrCreateAgentSchedulingGroup() {
if (!site_instance_group_)
GetProcess();
return site_instance_group_->agent_scheduling_group();
}
void SiteInstanceImpl::ResetSiteInstanceGroup() {
site_instance_group_.reset();
}
bool SiteInstanceImpl::IsRelatedSiteInstance(const SiteInstance* instance) {
return browsing_instance_.get() ==
static_cast<const SiteInstanceImpl*>(instance)
->browsing_instance_.get();
}
size_t SiteInstanceImpl::GetRelatedActiveContentsCount() {
return browsing_instance_->GetCoopRelatedGroupActiveContentsCount();
}
namespace {
bool SandboxConfigurationsMatch(const SiteInfo& site_info,
const UrlInfo& url_info) {
return site_info.is_sandboxed() == url_info.is_sandboxed &&
site_info.unique_sandbox_id() == url_info.unique_sandbox_id;
}
} // namespace
bool SiteInstanceImpl::IsSuitableForUrlInfo(const UrlInfo& url_info) {
const GURL& url = url_info.url;
DCHECK_CURRENTLY_ON(BrowserThread::UI);
// If the URL to navigate to can be associated with any site instance,
// we want to keep it in the same process.
if (blink::IsRendererDebugURL(url))
return true;
// Any process can host an about:blank URL, except the one used for error
// pages, which should not commit successful navigations. This check avoids a
// process transfer for browser-initiated navigations to about:blank in a
// dedicated process; without it, IsSuitableHost would consider this process
// unsuitable for about:blank when it compares process locks.
// Renderer-initiated navigations will handle about:blank navigations
// elsewhere and leave them in the source SiteInstance, along with
// about:srcdoc and data:.
if (url.IsAboutBlank() && !site_info_.is_error_page())
return true;
// The is_sandboxed flags and unique_sandbox_ids must match for this to be a
// suitable SiteInstance.
if (!SandboxConfigurationsMatch(GetSiteInfo(), url_info))
return false;
// If the site URL is an extension (e.g., for hosted apps or WebUI) but the
// process is not (or vice versa), make sure we notice and fix it.
// Note: This call must return information that is identical to what
// would be reported in the SiteInstance returned by
// GetRelatedSiteInstance(url).
SiteInfo site_info = DeriveSiteInfo(url_info, /* is_related= */ true);
// If this is a default SiteInstance and the BrowsingInstance gives us a
// non-default SiteInfo even when we explicitly allow the default SiteInstance
// to be considered, then |url| does not belong in the same process as this
// SiteInstance. This can happen when the
// kProcessSharingWithDefaultSiteInstances feature is not enabled and the
// site URL is explicitly set on a SiteInstance for a URL that would normally
// be directed to the default SiteInstance (e.g. a site not requiring a
// dedicated process). This situation typically happens when the top-level
// frame is a site that should be in the default SiteInstance and the
// SiteInstance associated with that frame is initially a SiteInstance with
// no site URL set.
if (IsDefaultSiteInstance() && site_info != site_info_)
return false;
// Note that HasProcess() may return true if site_instance_group_->process_ is
// null, in process-per-site cases where there's an existing process
// available. We want to use such a process in the IsSuitableHost check, so we
// may end up assigning process_ in the GetProcess() call below.
if (!HasProcess()) {
// If there is no process or site, then this is a new SiteInstance that can
// be used for anything.
if (!HasSite())
return true;
// If there is no process but there is a site, then the process must have
// been discarded after we navigated away. If the SiteInfos match, then it
// is safe to use this SiteInstance unless it is a guest. Guests are a
// special case because we need to be consistent with the HasProcess() path
// and the IsSuitableHost() call below always returns false for guests.
if (site_info_ == site_info)
return !IsGuest();
// If the site URLs do not match, but neither this SiteInstance nor the
// destination site_url require dedicated processes, then it is safe to use
// this SiteInstance.
if (!RequiresDedicatedProcess() &&
!site_info.RequiresDedicatedProcess(GetIsolationContext())) {
return true;
}
// Otherwise, there's no process, the SiteInfos don't match, and at least
// one of them requires a dedicated process, so it is not safe to use this
// SiteInstance.
return false;
}
return RenderProcessHostImpl::IsSuitableHost(
GetProcess(), GetIsolationContext(), site_info);
}
bool SiteInstanceImpl::RequiresDedicatedProcess() {
DCHECK_CURRENTLY_ON(BrowserThread::UI);
if (!has_site_)
return false;
return site_info_.RequiresDedicatedProcess(GetIsolationContext());
}
bool SiteInstanceImpl::RequiresOriginKeyedProcess() {
DCHECK_CURRENTLY_ON(BrowserThread::UI);
if (!has_site_)
return false;
// TODO(wjmaclean): once SiteInstanceGroups are ready we may give logically
// (same-process) isolated origins their own SiteInstances ... in that case we
// should consider updating this function.
return site_info_.requires_origin_keyed_process();
}
void SiteInstanceImpl::IncrementRelatedActiveContentsCount() {
browsing_instance_->IncrementActiveContentsCount();
}
void SiteInstanceImpl::DecrementRelatedActiveContentsCount() {
browsing_instance_->DecrementActiveContentsCount();
}
BrowserContext* SiteInstanceImpl::GetBrowserContext() {
return browsing_instance_->GetBrowserContext();
}
// static
scoped_refptr<SiteInstance> SiteInstance::Create(
BrowserContext* browser_context) {
DCHECK(browser_context);
return SiteInstanceImpl::Create(browser_context);
}
// static
scoped_refptr<SiteInstance> SiteInstance::CreateForURL(
BrowserContext* browser_context,
const GURL& url) {
return SiteInstanceImpl::CreateForURL(browser_context, url);
}
// static
scoped_refptr<SiteInstanceImpl> SiteInstanceImpl::CreateForURL(
BrowserContext* browser_context,
const GURL& url) {
DCHECK(browser_context);
return SiteInstanceImpl::CreateForUrlInfo(
browser_context, UrlInfo(UrlInfoInit(url)), /*is_guest=*/false,
/*is_fenced=*/false);
}
// static
scoped_refptr<SiteInstance> SiteInstance::CreateForGuest(
BrowserContext* browser_context,
const StoragePartitionConfig& partition_config) {
DCHECK(browser_context);
return SiteInstanceImpl::CreateForGuest(browser_context, partition_config);
}
// static
bool SiteInstance::ShouldAssignSiteForURL(const GURL& url) {
return SiteInstanceImpl::ShouldAssignSiteForUrlInfo(
UrlInfo(UrlInfoInit(url)));
}
bool SiteInstanceImpl::IsSameSiteWithURL(const GURL& url) {
return IsSameSiteWithURLInfo(UrlInfo(UrlInfoInit(url)));
}
bool SiteInstanceImpl::IsSameSiteWithURLInfo(const UrlInfo& url_info) {
const GURL& url = url_info.url;
if (IsDefaultSiteInstance()) {
// about:blank URLs should always be considered same site just like they are
// in IsSameSite().
if (url.IsAboutBlank())
return true;
// Consider |url| the same site if it could be handled by the
// default SiteInstance and we don't already have a SiteInstance for
// this URL.
// TODO(acolwell): Remove HasSiteInstance() call once we have a way to
// prevent SiteInstances with no site URL from being used for URLs
// that should be routed to the default SiteInstance.
DCHECK_EQ(site_info_.site_url(), GetDefaultSiteURL());
// We're only interested in knowning if we're same-site.
// WebExposedIsolationInfo should not come into play here so we make them
// match explicitly.
UrlInfo updated_url_info = url_info;
updated_url_info.web_exposed_isolation_info = GetWebExposedIsolationInfo();
auto site_info = SiteInfo::Create(GetIsolationContext(), updated_url_info);
return CanBePlacedInDefaultSiteInstance(GetIsolationContext(), url,
site_info) &&
!browsing_instance_->HasSiteInstance(site_info);
}
return SiteInstanceImpl::IsSameSite(
GetIsolationContext(), UrlInfo(UrlInfoInit(site_info_.site_url())),
url_info, true /* should_compare_effective_urls */);
}
bool SiteInstanceImpl::IsGuest() {
return site_info_.is_guest();
}
bool SiteInstanceImpl::IsJitDisabled() {
return site_info_.is_jit_disabled();
}
bool SiteInstanceImpl::IsPdf() {
return site_info_.is_pdf();
}
const StoragePartitionConfig& SiteInstanceImpl::GetStoragePartitionConfig() {
if (!has_site_) {
// Note: `site_info_` has not been set yet. This is ok as long as the
// StoragePartition of this SiteInstance does not change when `site_info_`
// is actually set. Enable the verification code in SetSiteInfoInternal()
// to verify that the storage partition info does not change.
verify_storage_partition_info_ = true;
}
return site_info_.storage_partition_config();
}
std::string SiteInstanceImpl::GetPartitionDomain(
StoragePartitionImpl* storage_partition) {
auto storage_partition_config = GetStoragePartitionConfig();
// The DCHECK here is to allow the trybots to detect any attempt to introduce
// new code that violates this assumption.
DCHECK_EQ(storage_partition->GetPartitionDomain(),
storage_partition_config.partition_domain());
if (storage_partition->GetPartitionDomain() !=
storage_partition_config.partition_domain()) {
// Trigger crash logging if we encounter a case that violates our
// assumptions.
SCOPED_CRASH_KEY_STRING256("GetPartitionDomain", "domain",
storage_partition->GetPartitionDomain());
SCOPED_CRASH_KEY_STRING256("GetPartitionDomain", "config_domain_key",
storage_partition_config.partition_domain());
base::debug::DumpWithoutCrashing();
// Return the value from the config to preserve legacy behavior until we
// can land a fix.
return storage_partition_config.partition_domain();
}
return storage_partition->GetPartitionDomain();
}
bool SiteInstanceImpl::IsOriginalUrlSameSite(
const UrlInfo& dest_url_info,
bool should_compare_effective_urls) {
if (IsDefaultSiteInstance())
return IsSameSiteWithURLInfo(dest_url_info);
// Here we use an |origin_isolation_request| of kNone (done implicitly in the
// UrlInfoInit constructor) when converting |original_url_| to UrlInfo, since
// (i) the isolation status of this SiteInstance was determined at the time
// |original_url_| was set, and in this case it is |dest_url_info| that is
// currently navigating, and that's where the current isolation request (if
// any) is stored. Whether or not this SiteInstance has origin isolation is a
// separate question, and not what the UrlInfo for |original_url_| is supposed
// to reflect.
return IsSameSite(GetIsolationContext(), UrlInfo(UrlInfoInit(original_url_)),
dest_url_info, should_compare_effective_urls);
}
bool SiteInstanceImpl::IsNavigationSameSite(
const GURL& last_successful_url,
const url::Origin& last_committed_origin,
bool for_outermost_main_frame,