Add settings for process models

See #4039, #2377
Fixes #4040

doc/changelog.asciidoc

@@ -32,6 +32,8 @@ Added
     QtWebEngine.
   * Opening a PDF file now doesn't start a second request anymore.
   * Opening PDFs on https:// sites now works properly.
+- New `qt.process_model` setting which can be used to change Chromium's process
+  model.
 
 Changed
 ~~~~~~~

doc/help/settings.asciidoc

@@ -229,6 +229,7 @@
 |<<qt.force_platform,qt.force_platform>>|Force a Qt platform to use.
 |<<qt.force_software_rendering,qt.force_software_rendering>>|Force software rendering for QtWebEngine.
 |<<qt.highdpi,qt.highdpi>>|Turn on Qt HighDPI scaling.
+|<<qt.process_model,qt.process_model>>|Which Chromium process model to use.
 |<<scrolling.bar,scrolling.bar>>|Show a scrollbar.
 |<<scrolling.smooth,scrolling.smooth>>|Enable smooth scrolling for web pages.
 |<<search.ignore_case,search.ignore_case>>|When to find text on a page case-insensitively.
@@ -2757,6 +2758,28 @@ Type: <<types,Bool>>
 
 Default: +pass:[false]+
 
+[[qt.process_model]]
+=== qt.process_model
+Which Chromium process model to use.
+Alternative process models use less resources, but decrease security and robustness.
+See the following pages for more details:
+
+  - https://www.chromium.org/developers/design-documents/process-models
+  - https://doc.qt.io/qt-5/qtwebengine-features.html#process-models
+This setting requires a restart.
+
+Type: <<types,String>>
+
+Valid values:
+
+ * +process-per-site-instance+: Pages from separate sites are put into separate processes and separate visits to the same site are also isolated.
+ * +process-per-site+: Pages from separate sites are put into separate processes. Unlike Process per Site Instance, all visits to the same site will share an OS process. The benefit of this model is reduced memory consumption, because more web pages will share processes. The drawbacks include reduced security, robustness, and responsiveness.
+ * +single-process+: Run all tabs in a single process. This should be used for debugging purposes only, and it disables `:open --private`.
+
+Default: +pass:[process-per-site-instance]+
+
+This setting is only available with the QtWebEngine backend.
+
 [[scrolling.bar]]
 === scrolling.bar
 Show a scrollbar.

qutebrowser/browser/commands.py

@@ -66,6 +66,11 @@ def __repr__(self):
 
     def _new_tabbed_browser(self, private):
         """Get a tabbed-browser from a new window."""
+        args = QApplication.instance().arguments()
+        if private and '--single-process' in args:
+            raise cmdexc.CommandError("Private windows are unavailable with "
+                                      "the single-process process model.")
+
         new_window = mainwindow.MainWindow(private=private)
         new_window.show()
         return new_window.tabbed_browser

qutebrowser/config/configdata.yml

@@ -181,6 +181,34 @@ qt.force_platform:
     This sets the `QT_QPA_PLATFORM` environment variable and is useful to force
     using the XCB plugin when running QtWebEngine on Wayland.
 
+qt.process_model:
+  type:
+    name: String
+    valid_values:
+      - process-per-site-instance: Pages from separate sites are put into
+            separate processes and separate visits to the same site are also
+            isolated.
+      - process-per-site: Pages from separate sites are put into separate
+            processes. Unlike Process per Site Instance, all visits to the same
+            site will share an OS process. The benefit of this model is reduced
+            memory consumption, because more web pages will share processes.
+            The drawbacks include reduced security, robustness, and
+            responsiveness.
+      - single-process: Run all tabs in a single process. This should be used
+            for debugging purposes only, and it disables `:open --private`.
+  default: process-per-site-instance
+  backend: QtWebEngine
+  restart: true
+  desc: >-
+    Which Chromium process model to use.
+
+    Alternative process models use less resources, but decrease security and
+    robustness.
+
+    See the following pages for more details:
+
+      - https://www.chromium.org/developers/design-documents/process-models
+      - https://doc.qt.io/qt-5/qtwebengine-features.html#process-models
 
 qt.highdpi:
   type: Bool

qutebrowser/config/configinit.py

@@ -27,7 +27,7 @@
 from qutebrowser.config import (config, configdata, configfiles, configtypes,
                                 configexc, configcommands)
 from qutebrowser.utils import (objreg, usertypes, log, standarddir, message,
-                               qtutils)
+                               qtutils, utils)
 from qutebrowser.config import configcache
 from qutebrowser.misc import msgbox, objects
 
@@ -191,4 +191,15 @@ def qt_args(namespace):
                 argv.append('--force-webrtc-ip-handling-policy='
                             'default_public_interface_only')
 
+        process_model = config.val.qt.process_model
+        if process_model == 'process-per-site-instance':
+            pass
+        elif process_model == 'process-per-site':
+            argv.append('--process-per-site')
+        elif process_model == 'single-process':
+            argv.append('--single-process')
+        else:
+            raise utils.Unreachable("Unknown process model {}"
+                                    .format(process_model))
+
     return argv

tests/unit/config/test_configinit.py

@@ -470,6 +470,28 @@ def test_canvas_reading(self, config_stub, monkeypatch, parser,
         args = configinit.qt_args(parsed)
         assert ('--disable-reading-from-canvas' in args) == added
 
+    @pytest.mark.parametrize('process_model, added', [
+        ('process-per-site-instance', False),
+        ('process-per-site', True),
+        ('single-process', True),
+    ])
+    def test_process_model(self, config_stub, monkeypatch, parser,
+                           process_model, added):
+        monkeypatch.setattr(configinit.objects, 'backend',
+                            usertypes.Backend.QtWebEngine)
+
+        config_stub.val.qt.process_model = process_model
+        parsed = parser.parse_args([])
+        args = configinit.qt_args(parsed)
+
+        if added:
+            assert '--' + process_model in args
+        else:
+            assert '--process-per-site' not in args
+            assert '--single-process' not in args
+            assert '--process-per-site-instance' not in args
+            assert '--process-per-tab' not in args
+
 
 @pytest.mark.parametrize('arg, confval, used', [
     # overridden by commandline arg