326021 - Fix lots of problems: Put each document in its own, independent process

Status: RESOLVED DUPLICATE of bug 260107

(Firefox :: General, enhancement)

Description

[Timothy Miller]

User-Agent:       Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.1 (like Gecko)
Build Identifier: 

This is a catch-all suggestion that would solve numerous problems that I encounter.  I have no idea how much effort this would require, but the usability boost would be worth the effort.  My suggestion is to spawn a separate PROCESS (not thread) for each document (window/tab).

Here are some reasons:

Firefox is memory-hungry.  When doing the obligatory search before filing this report, I found a very nice discussion on this.  Firefox leaks memory and doesn't make efficient use of non-leaked memory.  The problem comes when the system starts thrashing because FF's memory goes to swap.  When this happens, my instinct is to start closing tabs and bookmarking pages I want to save, but I can never do this, because FF causes massive thrashing, and always inevitably hangs up.  Closing documents doesn't free any memory back to the system, so the thrashing continues.  If documents had their own address spaces, closing tabs and windows WOULD free memory, giving me a chance to make the bookmarks.

Firefox has a tendency to freeze up.  There are various circumstances where this happens.  Some web pages use Javascript that gets into an infinite loop, but FF doesn't realize it and just hangs.  When FF causes thrashing, it's usually a prelude to a crash.  (It occurs to me now that that sudden onset of thrashing may be caused by a sudden runaway allocation of memory, and freeing memory wouldn't help.  It's going to crash anyway.)  It would be great if I could kill just the one hanging process and leave the rest running.

Firefox has a tendency to crash.  Since you don't have a crash-recovery system, it would at least be nice if only the one document would close, rather than taking everything with it.

A runaway isolated process can't take down the whole browser.  I've written my share of bugs that clobber memory I don't own.  With all documents in one address space, some weird page that hits a browser bug and sends it stomping on every document open would take everything down, rather than just the one document.

Security.  A buffer overflow or other information leak cannot cause sensitive data in one document to be available to another.  Particular in the case of an exploit, it can't get to the contents of other windows, because the IPC involved in moving data between documents would add complexity harder to exploit.

Even when functioning properly, closing a tab doesn't return memory to the system.  That's usually not a problem, but with FF being so memory-hungry, that really IS a problem.  With separate processes for each document, closing a document would shut down the entire process, freeing all the memory.  Plus, if the document hung, the shell could just kill the process.

With multiple processes, one hanging process won't make other documents unusable.  As it is, one hanging javascript program causes every tab of every window to completely freeze up.

If the shell (container for windows and some UI stuff) crashes, it would be nice to locate the document processes and reconnect.  The biggest drawback is that there's no way to forcibly kill all processes, unless you provide a tool to do it.  Also, the shell should be as minimal as possible, hoisting as much work as possible onto the worker processes so as to minimize the impact (or chances) of a shell crash.

I know that many of you are thinking that you should just fix the memory leaks and crashes.  That's noble, but it's as futile as Microsoft trying to fix all their buffer overflows.  The rate of feature additions is greater than the rate of bug fixing.  You can never fix all the problems, so all you can do is improve the robustness of the system so that when problems DO happen, they aren't so catastrophic.  Fail-safes.  I don't recall if FF has crash-recovery, but it it doesn't, it should.  But with separate processes, you don't even hardly need crash recovery, because you'll never have the whole browser crash.

Thank you for taking the time to read my rant.

Reproducible: Always

Comment 1

[Matthias Versen [:Matti]]

>My suggestion is to spawn a separate PROCESS (not thread) for each document >(window/tab).

possible for windows but not for Tabs

>Firefox is memory-hungry
Firefox would be really memory hungry if you create a new process for each window.

You can currently create more than one Firefox process under Linux if you want and also under Windows with a special setting but you need ONE profile for each window.



*** This bug has been marked as a duplicate of 260107 ***

Comment 2

[Timothy Miller]

I don't see why you can't do it for tabs.  Under X11, all you need is the resource ID of the window, and any process can draw to it.  I'm not sure about GDI, though; can one process get at another's window?

And why would FF be more memory hungry with separate processes?  Certainly not because of the code, because that would all be mapped to the same set of physical pages.  Page tables handled by the kernel?  I don't think they're that big.  I'm sure there's some extra overhead for a process, but I'm not sure that it's all that much.

And why is this marked as a duplicate?  It's most certainly NOT a duplicate of the bug you're pointing to.  The way I'm describing it, the separate processes would be tied together in a way that would NOT make them separate instances.

Look, Firefox has got serious problems.  And serious problems require desperate measures.  It's not like you're going to solve these problems a different way.