compositing: Split Servo up into multiple sandboxed processes.

Multiprocess mode is enabled with the `-M` switch, and sandboxing is
enabled with the `-S` switch.

components/compositing/Cargo.toml

@@ -22,6 +22,9 @@ path = "../script_traits"
 [dependencies.style_traits]
 path = "../style_traits"
 
+[dependencies.style]
+path = "../style"
+
 [dependencies.msg]
 path = "../msg"
 
@@ -70,12 +73,18 @@ features = ["texture_surface"]
 version = "0.2"
 features = [ "serde_serialization" ]
 
+[dependencies.gaol]
+git = "https://github.com/pcwalton/gaol"
+
 [dependencies]
+libc = "0.1"
 log = "0.3"
 num = "0.1.24"
 time = "0.1.17"
 gleam = "0.1"
 euclid = "0.2"
+serde = "0.6"
+serde_macros = "0.5"
 
 [target.x86_64-apple-darwin.dependencies]
 core-graphics = "0.1"

components/compositing/compositor.rs

@@ -13,9 +13,9 @@ use euclid::size::TypedSize2D;
 use euclid::{Matrix4, Point2D, Rect, Size2D};
 use gfx::paint_task::{ChromeToPaintMsg, PaintRequest};
 use gfx_traits::color;
-use gleam::gl;
 use gleam::gl::types::{GLint, GLsizei};
-use ipc_channel::ipc;
+use gleam::gl;
+use ipc_channel::ipc::{self, IpcSender};
 use ipc_channel::router::ROUTER;
 use layers::geometry::{DevicePixel, LayerPixel};
 use layers::layers::{BufferRequest, Layer, LayerBuffer, LayerBufferSet};
@@ -41,7 +41,6 @@ use std::collections::{HashMap, HashSet};
 use std::mem as std_mem;
 use std::rc::Rc;
 use std::slice::bytes::copy_memory;
-use std::sync::mpsc::Sender;
 use style_traits::viewport::ViewportConstraints;
 use surface_map::SurfaceMap;
 use time::{precise_time_ns, precise_time_s};
@@ -620,7 +619,7 @@ impl<Window: WindowMethods> IOCompositor<Window> {
 
     fn set_frame_tree(&mut self,
                       frame_tree: &SendableFrameTree,
-                      response_chan: Sender<()>,
+                      response_chan: IpcSender<()>,
                       new_constellation_chan: ConstellationChan) {
         response_chan.send(()).unwrap();
 

components/compositing/compositor_task.rs

@@ -5,9 +5,10 @@
 //! Communication with the compositor task.
 
 use compositor;
-use euclid::{Point2D, Size2D};
+use euclid::point::Point2D;
+use euclid::size::Size2D;
 use headless;
-use ipc_channel::ipc::{IpcReceiver, IpcSender};
+use ipc_channel::ipc::{self, IpcReceiver, IpcSender};
 use layers::layers::{BufferRequest, LayerBufferSet};
 use layers::platform::surface::{NativeDisplay, NativeSurface};
 use msg::compositor_msg::{Epoch, FrameTreeId, LayerId, LayerProperties};
@@ -63,11 +64,11 @@ pub fn run_script_listener_thread(compositor_proxy: Box<CompositorProxy + 'stati
                                   receiver: IpcReceiver<ScriptToCompositorMsg>) {
     while let Ok(msg) = receiver.recv() {
         match msg {
-            ScriptToCompositorMsg::ScrollFragmentPoint(pipeline_id, layer_id, point, _smooth) => {
+            ScriptToCompositorMsg::ScrollFragmentPoint(pipeline_id, layer_id, point, smooth) => {
                 compositor_proxy.send(Msg::ScrollFragmentPoint(pipeline_id,
                                                                layer_id,
                                                                point,
-                                                               _smooth));
+                                                               smooth));
             }
 
             ScriptToCompositorMsg::GetClientWindow(send) => {
@@ -83,7 +84,7 @@ pub fn run_script_listener_thread(compositor_proxy: Box<CompositorProxy + 'stati
             }
 
             ScriptToCompositorMsg::Exit => {
-                let (chan, port) = channel();
+                let (chan, port) = ipc::channel().unwrap();
                 compositor_proxy.send(Msg::Exit(chan));
                 port.recv().unwrap();
             }
@@ -151,7 +152,7 @@ impl PaintListener for Box<CompositorProxy + 'static + Send> {
 /// Messages from the painting task and the constellation task to the compositor task.
 pub enum Msg {
     /// Requests that the compositor shut down.
-    Exit(Sender<()>),
+    Exit(IpcSender<()>),
 
     /// Informs the compositor that the constellation has completed shutdown.
     /// Required because the constellation can have pending calls to make
@@ -179,7 +180,7 @@ pub enum Msg {
     /// Alerts the compositor that the given pipeline has changed whether it is running animations.
     ChangeRunningAnimationsState(PipelineId, AnimationState),
     /// Replaces the current frame tree, typically called during main frame navigation.
-    SetFrameTree(SendableFrameTree, Sender<()>, ConstellationChan),
+    SetFrameTree(SendableFrameTree, IpcSender<()>, ConstellationChan),
     /// The load of a page has begun: (can go back, can go forward).
     LoadStart(bool, bool),
     /// The load of a page has completed: (can go back, can go forward).

components/compositing/constellation.rs

@@ -18,8 +18,10 @@ use compositor_task::Msg as CompositorMsg;
 use devtools_traits::{ChromeToDevtoolsControlMsg, DevtoolsControlMsg};
 use euclid::scale_factor::ScaleFactor;
 use euclid::size::{Size2D, TypedSize2D};
+use gaol::sandbox::{self, Sandbox, SandboxMethods};
+use gaol;
 use gfx::font_cache_task::FontCacheTask;
-use ipc_channel::ipc::{self, IpcSender};
+use ipc_channel::ipc::{self, IpcOneShotServer, IpcReceiver, IpcSender};
 use layout_traits::{LayoutControlChan, LayoutTaskFactory};
 use msg::compositor_msg::Epoch;
 use msg::constellation_msg::AnimationState;
@@ -35,18 +37,20 @@ use net_traits::image_cache_task::ImageCacheTask;
 use net_traits::storage_task::{StorageTask, StorageTaskMsg};
 use net_traits::{self, ResourceTask};
 use offscreen_gl_context::GLContextAttributes;
-use pipeline::{CompositionPipeline, InitialPipelineState, Pipeline};
+use pipeline::{CompositionPipeline, InitialPipelineState, Pipeline, UnprivilegedPipelineContent};
+use sandboxing;
 use profile_traits::mem;
 use profile_traits::time;
 use script_traits::{CompositorEvent, ConstellationControlMsg, LayoutControlMsg};
 use script_traits::{ScriptState, ScriptTaskFactory};
 use std::borrow::ToOwned;
 use std::collections::HashMap;
+use std::env;
 use std::io::{self, Write};
 use std::marker::PhantomData;
 use std::mem::replace;
 use std::process;
-use std::sync::mpsc::{Receiver, Sender, channel};
+use std::sync::mpsc::{Sender, channel};
 use style_traits::viewport::ViewportConstraints;
 use url::Url;
 use util::cursor::Cursor;
@@ -65,7 +69,7 @@ pub struct Constellation<LTF, STF> {
     pub chan: ConstellationChan,
 
     /// Receives messages.
-    pub request_port: Receiver<ConstellationMsg>,
+    pub request_port: IpcReceiver<ConstellationMsg>,
 
     /// A channel (the implementation of which is port-specific) through which messages can be sent
     /// to the compositor.
@@ -138,6 +142,9 @@ pub struct Constellation<LTF, STF> {
     /// A list of senders that are waiting to be notified whenever a pipeline or subpage ID comes
     /// in.
     subpage_id_senders: HashMap<(PipelineId, SubpageId), Vec<IpcSender<PipelineId>>>,
+
+    /// A list of child content processes.
+    child_processes: Vec<ChildProcess>,
 }
 
 /// State needed to construct a constellation.
@@ -241,6 +248,11 @@ enum ExitPipelineMode {
     Force,
 }
 
+enum ChildProcess {
+    Sandboxed(gaol::platform::process::Process),
+    Unsandboxed(process::Child),
+}
+
 impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
     pub fn start(state: InitialConstellationState) -> ConstellationChan {
         let (constellation_port, constellation_chan) = ConstellationChan::new();
@@ -283,6 +295,7 @@ impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
                 canvas_paint_tasks: Vec::new(),
                 webgl_paint_tasks: Vec::new(),
                 subpage_id_senders: HashMap::new(),
+                child_processes: Vec::new(),
             };
             constellation.run();
         });
@@ -302,15 +315,15 @@ impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
     fn new_pipeline(&mut self,
                     parent_info: Option<(PipelineId, SubpageId)>,
                     initial_window_size: Option<TypedSize2D<PagePx, f32>>,
-                    script_channel: Option<Sender<ConstellationControlMsg>>,
+                    script_channel: Option<IpcSender<ConstellationControlMsg>>,
                     load_data: LoadData)
                     -> PipelineId {
         let pipeline_id = self.next_pipeline_id;
         let PipelineId(ref mut i) = self.next_pipeline_id;
         *i += 1;
 
         let spawning_paint_only = script_channel.is_some();
-        let (pipeline, mut pipeline_content) =
+        let (pipeline, unprivileged_pipeline_content, mut privileged_pipeline_content) =
             Pipeline::create::<LTF, STF>(InitialPipelineState {
                 id: pipeline_id,
                 parent_info: parent_info,
@@ -329,12 +342,39 @@ impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
                 device_pixel_ratio: self.window_size.device_pixel_ratio,
             });
 
-        // TODO(pcwalton): In multiprocess mode, send that `PipelineContent` instance over to
-        // the content process and call this over there.
         if spawning_paint_only {
-            pipeline_content.start_paint_task();
+            privileged_pipeline_content.start_paint_task();
         } else {
-            pipeline_content.start_all::<LTF, STF>();
+            privileged_pipeline_content.start_all();
+
+            // Spawn the child process.
+            //
+            // Yes, that's all there is to it!
+            if opts::multiprocess() {
+                let (server, token) =
+                    IpcOneShotServer::<IpcSender<UnprivilegedPipelineContent>>::new().unwrap();
+
+                // If there is a sandbox, use the `gaol` API to create the child process.
+                let child_process = if opts::get().sandbox {
+                    let mut command = sandbox::Command::me().unwrap();
+                    command.arg("--content-process").arg(token);
+                    let profile = sandboxing::content_process_sandbox_profile();
+                    ChildProcess::Sandboxed(Sandbox::new(profile).start(&mut command).expect(
+                        "Failed to start sandboxed child process!"))
+                } else {
+                    let path_to_self = env::current_exe().unwrap();
+                    let mut child_process = process::Command::new(path_to_self);
+                    child_process.arg("--content-process");
+                    child_process.arg(token);
+                    ChildProcess::Unsandboxed(child_process.spawn().unwrap())
+                };
+                self.child_processes.push(child_process);
+
+                let (_receiver, sender) = server.accept().unwrap();
+                sender.send(unprivileged_pipeline_content).unwrap();
+            } else {
+                unprivileged_pipeline_content.start_all::<LTF, STF>(false);
+            }
         }
 
         assert!(!self.pipelines.contains_key(&pipeline_id));
@@ -1227,7 +1267,7 @@ impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
 
             // Synchronously query the script task for this pipeline
             // to see if it is idle.
-            let (sender, receiver) = channel();
+            let (sender, receiver) = ipc::channel().unwrap();
             let msg = ConstellationControlMsg::GetCurrentState(sender, frame.current);
             pipeline.script_chan.send(msg).unwrap();
             let result = receiver.recv().unwrap();
@@ -1389,7 +1429,7 @@ impl<LTF: LayoutTaskFactory, STF: ScriptTaskFactory> Constellation<LTF, STF> {
         if let Some(root_frame_id) = self.root_frame_id {
             let frame_tree = self.frame_to_sendable(root_frame_id);
 
-            let (chan, port) = channel();
+            let (chan, port) = ipc::channel().unwrap();
             self.compositor_proxy.send(CompositorMsg::SetFrameTree(frame_tree,
                                                                    chan,
                                                                    self.chan.clone()));

components/compositing/lib.rs

@@ -3,13 +3,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #![feature(box_syntax)]
+#![feature(custom_derive)]
 #![feature(iter_cmp)]
+#![feature(plugin)]
 #![feature(slice_bytes)]
 #![feature(vec_push_all)]
 #![feature(plugin)]
 #![plugin(plugins)]
 
 #![deny(unsafe_code)]
+#![plugin(serde_macros)]
 
 #[macro_use]
 extern crate log;
@@ -29,6 +32,7 @@ extern crate core_text;
 
 extern crate devtools_traits;
 extern crate euclid;
+extern crate gaol;
 extern crate gfx;
 extern crate gfx_traits;
 extern crate gleam;
@@ -41,7 +45,11 @@ extern crate num;
 extern crate offscreen_gl_context;
 extern crate png;
 extern crate script_traits;
+extern crate serde;
+extern crate style;
 extern crate style_traits;
+
+extern crate libc;
 extern crate time;
 extern crate url;
 
@@ -56,4 +64,5 @@ mod surface_map;
 pub mod compositor_task;
 pub mod constellation;
 pub mod pipeline;
+pub mod sandboxing;
 pub mod windowing;