Hacker News Reader

Comment by bitmapbrother | Hacker News Reader

The test mentions he ran Firefox using 2, 4 and 8 content processes. Does this mean that Firefox does not use 1 process per tab like Chrome does?

View on HN

Firefox can be configured to use N number of content processes, and will allocate tabs among these processes. In FirefoxOS we were giving a new process to each tab/app, using a pre-allocated process to speed up startup (a version of that has been re-implemented for Firefox).

I'm not sure about the exact heuristics used by Chrome, but I think they do something like one process per origin.

Yes, Chrome uses 1 process per domain. So I'm still not sure what would happen if Firefox is configured to use 4 content processes and 20 unique domain tabs are opened. Would the domains be distributed to these content processes? And what happens if 1 content process crashes? Would it also bring down all of the domains associated to it?

The answers to your questions are yes and yes.

Chrome does not use one process per tab: open the Chrome task manager and you can see how it groups tabs by which process they are within.

I opened up 16 unique top level domain URL's. Process explorer indicated that there were 21 processes of chrome.exe.

edit: as noted below it's one process per domain.

Chrome by default uses a process per domain, and shares that process with other tabs on the same domain. This is to align with security boundaries.

Thanks for the clarification as I had always assumed it was one process per tab. Since it's one process per domain if one tab crashes does it also bring down the other tabs in the same domain?

Yep.

Recent versions of Firefox have been pushing out pr tab process support (it has been called different things at different stages of development, i think the current label is e10s). There has been some controversy around this, as such support has in part been responsible for the removal of extensions in their traditional form.

It does not. They are experimenting with different models and will probably use 4 processes for all tabs.

I was under the impression the primary benefits of the process design were containing failure and jailing vulnerabilities to avoid them from accessing your other tabs. Why not do one process per iframe/origin?

More processes do have benefits, but they increase memory usage, as measured in that link.

AIUI It's about separating all untrusted web content from everything else on your computer. As long as you have _one_ content process (and one parent/browser process), you get the vast majority of security benefits (by limiting the capabilities of that child content process).

The same origin policy already works fine, when talking content-to-content.

Reply on news.ycombinator.com