debug chromium project - create sub proces

前言

chromium主程序运行时，是靠子进程来干活的，带不同参数干不同活.
子进程有工具类的(crash process), 有页面渲染的。还没有具体去跟，只有跟着不同参数的子进程再跑，才能知道具体干了啥，是怎么干的。
这个试验，先确定chromium主进程，创建子进程的点，启动的子进程数量，启动子进程的时机，猜子进程的功能(按照子进程参数猜).

试验

chromium进程创建点

chromium启动后，在主UI出来之前，就会建立4个chrome, 不包括启动后，又结束的chrome工具子进程
主进程创建子进程的点共有3个：
A : D:\chrominum\src\third_party\crashpad\crashpad\client\crashpad_client_win.cc:480
B : D:\chrominum\src\base\process\launch_win.cc:299
C : D:\chrominum\src\sandbox\win\src\target_process.cc:165

A, B点是chromium初始化时建立的子进程，每个点只新建一个子进程
C点是新建内嵌页面或 (输入url时 + 回车) 新建的子进程，如果输入的url是无效的，任务循环会因为重新刷页面，再新建渲染子进程(根据参数猜的).

C点所在的任务循环层次关系
void SchedulerWorker::RunWorker() => while (!ShouldExit()) // 这是一个任务循环, 如果有任务就启动，否则就等结束标记
TaskTracker::RunAndPopNextTask()
TaskTracker::RunOrSkipTask()
TaskAnnotator::RunTask()
ChildProcessLauncherHelper::LaunchOnLauncherThread()
ChildProcessLauncherHelper::LaunchProcessOnLauncherThread()
sandbox::ResultCode StartSandboxedProcess()
sandbox::ResultCode SandboxWin::StartSandboxedProcess()

下一步的试验设想

chromium是用子进程来干活的，不同参数干不同事情.
工程太大了，准备修改程序入口点，将参数, PID，PPID打印出来，弹框。
将主程序(首个chrome.exe)非调试状态跑起来，遇到感兴趣的带参数子进程，就附加进去单步走流程，这样就能知道输入url后，启动的子进程具体作用是什么，如何去拿url远端数据。

试验数据

工程中用到的进程相关的函数CreateProcess
CreateProcessA
CreateProcessWCreateProcessAsUser
CreateProcessAsUserW// 启动的进程和位置
主程序启动
到这里, 任务管理器里面有1个chrome.exeD:\chrominum\src\third_party\crashpad\crashpad\client\crashpad_client_win.cc:480
D:\chrominum\src\out\Default\chrome.exe --type=crashpad-handler "--user-data-dir=C:\Users\LostSpeed\AppData\Local\Chromium\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\LostSpeed\AppData\Local\Chromium\User Data\Crashpad" "--metrics-dir=C:\Users\LostSpeed\AppData\Local\Chromium\User Data" --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=68.0.3424.0-devel --initial-client-data=0x23c,0x240,0x244,0x238,0x248,0x7fffe3f70078,0x7fffe3f70084,0x7fffe3f70048
到这里, 任务管理器里面有2个chrome.exe沙箱进程
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=gpu-process --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --start-stack-profiler --gpu-preferences=KAAAAAAAAACAAwBgAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --start-stack-profiler --service-request-channel-token=C9BDADA8A3E7CA86FB42625A3C3828F6 --mojo-platform-channel-handle=1672 --ignored=" --type=renderer " /prefetch:2
到这里, 任务管理器里面有3个chrome.exe沙箱进程
D:\chrominum\src\base\process\launch_win.cc:299
"D:\chrominum\src\out\Default\chrome.exe" --type=gpu-process --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --disable-gpu-sandbox --start-stack-profiler --gpu-preferences=KAAAAAAAAACAAwBgAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --start-stack-profiler --service-request-channel-token=23EC725222AE3A68FCA02BBE024ED9EB --mojo-platform-channel-handle=1940 /prefetch:2
到这里, 任务管理器里面有4个chrome.exe沙箱进程
到这里, 任务管理器里面有3个chrome.exe
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=3F9A9A5790BBF278B79E8A731B47A9A6 --lang=zh-CN --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=3F9A9A5790BBF278B79E8A731B47A9A6 --renderer-client-id=5 --mojo-platform-channel-handle=2504 /prefetch:1
到这里, 任务管理器里面有4个chrome.exe, chrome界面出来了沙箱进程
到这里, 任务管理器里面有4个chrome.exe, chrome界面出来了
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=FB689E378C80F09AA4884573DE3265C9 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=FB689E378C80F09AA4884573DE3265C9 --renderer-client-id=6 --mojo-platform-channel-handle=4200 /prefetch:1
到这里, 任务管理器里面有5个chrome.exe, chrome界面出来了沙箱进程, 这是一个提示框，说要不要恢复页面。
到这里, 任务管理器里面有5个chrome.exe, chrome界面出来了
D:\chrominum\src\base\process\launch_win.cc:299
"D:\chrominum\src\out\Default\chrome.exe" --type=utility --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --lang=zh-CN --no-sandbox --service-request-channel-token=6FA04EB52F296198552636EB3F9EC406 --mojo-platform-channel-handle=4380 /prefetch:8
到这里, 任务管理器里面有5个chrome.exe, chrome界面出来了到这里, 任务管理器里面有4个chrome.exe, chrome界面出来了
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=utility --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --lang=zh-CN --service-sandbox-type=utility --service-request-channel-token=EBCBF92786F883AEB2260656DD3F7FAD --mojo-platform-channel-handle=1420 --ignored=" --type=renderer " /prefetch:8
到这里, 任务管理器里面有5个chrome.exe, chrome界面出来了到这里, 任务管理器里面有4个chrome.exe, chrome界面出来了
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=B4FDCA8813E614ED49C32FF7D6DB5F3E --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=B4FDCA8813E614ED49C32FF7D6DB5F3E --renderer-client-id=9 --mojo-platform-channel-handle=3088 /prefetch:1到这里, 任务管理器里面有5个chrome.exe, chrome界面出来了
"D:\chrominum\src\out\Default\chrome.exe" --type=utility --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --lang=zh-CN --service-sandbox-type=utility --service-request-channel-token=D03B73C77950929F1681E0998FBEE3A3 --mojo-platform-channel-handle=4124 --ignored=" --type=renderer " /prefetch:8
这个进程是提示页面，说“未正常关闭，要恢复页面么？”。可能是调试的缘故。// 这是有任务循环工作者启动的主UI
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=5BA90E8A8815E761C735DA23570FCE9A --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=5BA90E8A8815E761C735DA23570FCE9A --renderer-client-id=11 --mojo-platform-channel-handle=5384 /prefetch:1
到这里, 任务管理器里面有6个chrome.exe, chrome界面出来了
调用点:
sandbox::ResultCode SandboxWin::StartSandboxedProcess()
sandbox::ResultCode StartSandboxedProcess()
ChildProcessLauncherHelper::LaunchProcessOnLauncherThread()
ChildProcessLauncherHelper::LaunchOnLauncherThread()
TaskAnnotator::RunTask()
TaskTracker::RunOrSkipTask()
TaskTracker::RunAndPopNextTask()
void SchedulerWorker::RunWorker() => while (!ShouldExit()) // 这是一个任务循环, 如果有任务就启动，否则就等结束标记在主UI输入url回车后，启动了线程 ThreadFunc_rc_dword(), 由线程自动子进程(先后启动了2个子进程)
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=0C8674CD51388AC22F2FE11A8CC66566 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=0C8674CD51388AC22F2FE11A8CC66566 --renderer-client-id=12 --mojo-platform-channel-handle=6552 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=D73821D9B612ED80D75787EA7D95C1F9 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=D73821D9B612ED80D75787EA7D95C1F9 --renderer-client-id=13 --mojo-platform-channel-handle=4056 /prefetch:1CTRL + N 新建tab页时，也启动了2个子进程
D:\chrominum\src\sandbox\win\src\target_process.cc:165
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=2C5B91947805325C2D071BD11CFF73AB --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2C5B91947805325C2D071BD11CFF73AB --renderer-client-id=14 --mojo-platform-channel-handle=7356 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=14B2EA2FD069F7FC520684E218DCD552 --lang=zh-CN --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=14B2EA2FD069F7FC520684E218DCD552 --renderer-client-id=15 --mojo-platform-channel-handle=4804 /prefetch:1在新建tab页输入url回车时，启动了2进程，应该是是去拿远端url数据的
第一个进程命令行忘记记录了
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=38D9EE83E7689D3271A7C0252BC21AC5 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=38D9EE83E7689D3271A7C0252BC21AC5 --renderer-client-id=17 --mojo-platform-channel-handle=6764 /prefetch:1再重复一次新建TAB页, 新建2个子进程
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=D61371FCD217C944AD45981186E12F23 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=D61371FCD217C944AD45981186E12F23 --renderer-client-id=18 --mojo-platform-channel-handle=8472 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=84ACAEED8A6ED32E6C7A5734BB20E503 --lang=zh-CN --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=84ACAEED8A6ED32E6C7A5734BB20E503 --renderer-client-id=19 --mojo-platform-channel-handle=5540 /prefetch:1重复 ： 在新建tab页输入url回车时，启动了2进程，应该是是去拿远端url数据的
如果输入的是错误url
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=C59DBD0A765B23D2DA7512B71C77FF0D --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=C59DBD0A765B23D2DA7512B71C77FF0D --renderer-client-id=23 --mojo-platform-channel-handle=9956 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=96E10BB0B8F734153D0E4F74A6E2FF7D --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=96E10BB0B8F734153D0E4F74A6E2FF7D --renderer-client-id=24 --mojo-platform-channel-handle=10648 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=6896311F0CFA122D45B674532F890442 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=6896311F0CFA122D45B674532F890442 --renderer-client-id=25 --mojo-platform-channel-handle=10092 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=2B195E6B1C572D103D36E58C05ABB603 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2B195E6B1C572D103D36E58C05ABB603 --renderer-client-id=26 --mojo-platform-channel-handle=10016 /prefetch:1
"D:\chrominum\src\out\Default\chrome.exe" --type=renderer --field-trial-handle=1660,13290008870057280231,2031410662699215295,131072 --service-pipe-token=676C0183AE316CCBB0D42C36B554DC46 --lang=zh-CN --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --start-stack-profiler --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=676C0183AE316CCBB0D42C36B554DC46 --renderer-client-id=27 --mojo-platform-channel-handle=7972 /prefetch:1
错误的url会不断去重试页面, 会不断地新建子进程