Many of today’s web sites contain substantial amounts of
client-side code, and consequently, they act more like programs
than simple documents. This creates robustness and
performance challenges for web browsers. To give users a
robust and responsive platform, the browser must identify
program boundaries and provide isolation between them.
We provide three contributions in this paper. First, we
present abstractions of web programs and program instances,
and we show that these abstractions clarify how
browser components interact and how appropriate program
boundaries can be identified. Second, we identify backwards
compatibility tradeoffs that constrain how web content can
be divided into programs without disrupting existing web
sites. Third, we present a multi-process browser architecture
that isolates these web program instances from each other,
improving fault tolerance, resource management, and performance.
We discuss how this architecture is implemented in
Google Chrome, and we provide a quantitative performance
evaluation examining its benefits and costs.