Ensure that the DirectWrite font cache works in Chrome canary on Windows 8+ with AppContainer protection.

The DirectWrite font cache is mapped as a shared section by the renderer processes. The browser creates
the section. On Windows 8+ with AppContainer protection the renderers are unable to open this shared section
as the BaseNamedObjects object directory is virtualized to \Sessions\SessionId\AppContainerNamedObjects.

This effectively means that the renderers now fallback to the old method of enumerating all fonts while DirectWrite
builds up its font cache. This hurts performance.

Proposed fix is as below :-
1. When the renderer process is launched we get notified in the RenderProcessHost::OnProcessLaunched method.
   We send a control IPC message here ViewMsg_FontCacheSectionHandle which contains the duplicated font cache
   section handle.

2. The ViewMsg_FontCacheSectionHandle message is handled by RenderThreadImpl. It ensures that the shared handle
   is set by calling a helper function SetFontCacheSectionHandle. This function then triggers the setting of the
   DirectWrite font factory in skia.

3. Some of the code in the WarmupDirectWrite function is no longer needed like the code to create the font factory
   and create some fonts to warm up DirectWrite. This is because DirectWrite in the renderer now uses the custom
   font collection which means that most of the code now can run in the sandbox. The only parts which need to run
   outside the sandbox are the loading of the dwrite.dll and the code in the FontCollectionLoader which reads fonts
   from the registry.

4. The GetPreSandboxWarmupFontMgr helper function has been renamed to GetDirectWriteFontManager.

The UMA metric DirectWrite.Fonts.LoadTime.Cached should be available if the font cache is loaded in the renderer.

BUG=481285
R=cpu

Review URL: https://codereview.chromium.org/1105763004

Cr-Commit-Position: refs/heads/master@{#327804}

19 files changed, 202 insertions, 58 deletions

diff --git a/content/browser/battery_status/battery_monitor_integration_browsertest.cc b/content/browser/battery_status/battery_monitor_integration_browsertest.cc
index 541d769..a201ef8 100644
--- a/content/browser/battery_status/battery_monitor_integration_browsertest.cc
+++ b/content/browser/battery_status/battery_monitor_integration_browsertest.cc
@@ -101,6 +101,13 @@ class TestContentBrowserClient : public ContentBrowserClient {
         command_line, child_process_id, mappings);
   }
 #endif  // defined(OS_ANDROID)
+
+#if defined(OS_WIN)
+  void PreSpawnRenderer(sandbox::TargetPolicy* policy,
+                        bool* success) override {
+    ShellContentBrowserClient::AddFontSpecificFSPolicies(policy);
+  }
+#endif
 };
 
 class BatteryMonitorIntegrationTest : public ContentBrowserTest {
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 29c1ff1..137a8d5 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -175,11 +175,17 @@
 #endif
 
 #if defined(OS_WIN)
+#include "base/memory/shared_memory.h"
+#include "base/strings/string16.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/win/scoped_com_initializer.h"
+#include "base/win/scoped_handle.h"
 #include "base/win/windows_version.h"
 #include "content/common/font_cache_dispatcher_win.h"
 #include "content/common/sandbox_win.h"
+#include "content/public/common/dwrite_font_platform_win.h"
 #include "sandbox/win/src/sandbox_policy.h"
+#include "ui/gfx/win/direct_write.h"
 #include "ui/gfx/win/dpi.h"
 #endif
 
@@ -1194,9 +1200,6 @@ void RenderProcessHostImpl::AppendRendererCommandLine(
 #if defined(OS_WIN)
   command_line->AppendSwitchASCII(switches::kDeviceScaleFactor,
                                   base::DoubleToString(gfx::GetDPIScale()));
-  command_line->AppendSwitchASCII(
-      switches::kFontCacheSharedMemSuffix,
-      base::UintToString(base::GetCurrentProcId()));
 #endif
 
   AppendCompositorCommandLineFlags(command_line);
@@ -2334,6 +2337,9 @@ void RenderProcessHostImpl::OnProcessLaunched() {
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
           "465841 "
           "RenderProcessHostImpl::OnProcessLaunched::SendQueuedMessages"));
+
+  PlatformProcessLaunched();
+
   while (!queued_messages_.empty()) {
     Send(queued_messages_.front());
     queued_messages_.pop();
@@ -2491,4 +2497,28 @@ void RenderProcessHostImpl::GetAudioOutputControllers(
   audio_renderer_host()->GetOutputControllers(callback);
 }
 
+#if !defined(OS_WIN)
+void RenderProcessHostImpl::PlatformProcessLaunched() {}
+#else
+void RenderProcessHostImpl::PlatformProcessLaunched() {
+  // If DirectWrite is enabled for font rendering then this function sends the
+  // font cache section handle to the renderer process. If the handle is not
+  // available (which could happen if we are launched as part of content, or
+  // because the cache is not available yet), then we send a NULL section handle
+  // to the renderer which ensures that the DirectWrite factory is initialized
+  // correctly.
+  if (!run_renderer_in_process() && gfx::win::ShouldUseDirectWrite()) {
+    std::string name(content::kFontCacheSharedSectionName);
+    name.append(base::UintToString(base::GetCurrentProcId()));
+    base::SharedMemory font_cache_section;
+    base::SharedMemoryHandle mapped_handle = NULL;
+    if (font_cache_section.Open(name, true)) {
+      font_cache_section.ShareReadOnlyToProcess(GetHandle(), &mapped_handle);
+      DCHECK(mapped_handle);
+    }
+    Send(new ViewMsg_DirectWriteFontCacheSectionHandle(mapped_handle));
+  }
+}
+#endif
+
 }  // namespace content
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 5a6935b..92fc5d8 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -353,6 +353,9 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void SendDisableAecDumpToRenderer();
 #endif
 
+  // Platform specific handling for renderer process launches goes here.
+  void PlatformProcessLaunched();
+
   scoped_ptr<MojoApplicationHost> mojo_application_host_;
 
   // The registered IPC listener objects. When this list is empty, we should
diff --git a/content/common/dwrite_font_platform_win.cc b/content/common/dwrite_font_platform_win.cc
index 4847963..3eccac1 100644
--- a/content/common/dwrite_font_platform_win.cc
+++ b/content/common/dwrite_font_platform_win.cc
@@ -142,6 +142,10 @@ bool ValidateFontCacheHeader(CacheFileHeader* header) {
 
 class FontCacheWriter;
 
+// Handle to the global font cache section. Owned by the shared section
+// instance which maps it.
+HANDLE g_font_cache_section = NULL;
+
 // This class implements main interface required for loading custom font
 // collection as specified by DirectWrite. We also use this class for storing
 // some state information as this is one of the centralized entity.
@@ -712,16 +716,8 @@ HRESULT STDMETHODCALLTYPE FontCollectionLoader::CreateEnumeratorFromKey(
 
 // static
 HRESULT FontCollectionLoader::Initialize(IDWriteFactory* factory) {
-  DCHECK(g_font_loader == NULL);
-
-  HRESULT result;
-  result = mswr::MakeAndInitialize<FontCollectionLoader>(&g_font_loader);
-  if (FAILED(result) || !g_font_loader) {
-    DCHECK(false);
-    return E_FAIL;
-  }
-
-  CHECK(g_font_loader->LoadFontListFromRegistry());
+  content::InitializeFontLoader();
+  CHECK(g_font_loader);
 
   g_font_loader->file_loader_ = mswr::Make<FontFileLoader>().Detach();
 
@@ -921,17 +917,12 @@ bool FontCollectionLoader::IsFileCached(UINT32 font_key) {
 }
 
 bool FontCollectionLoader::LoadCacheFile() {
-  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kFontCacheSharedMemSuffix)) {
-    return false;
-  }
-  base::SharedMemory* shared_mem = new base::SharedMemory();
-  std::string name(content::kFontCacheSharedSectionName);
-  name.append(base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
-                  switches::kFontCacheSharedMemSuffix));
-  if (!shared_mem->Open(name.c_str(), true))
+  if (!g_font_cache_section)
     return false;
 
+  base::SharedMemory* shared_mem = new base::SharedMemory(
+      g_font_cache_section, true);
+
   // Map while file
   shared_mem->Map(0);
 
@@ -1109,7 +1100,7 @@ IDWriteFontCollection* GetCustomFontCollection(IDWriteFactory* factory) {
 
 bool BuildFontCacheInternal(const WCHAR* file_name) {
   typedef decltype(DWriteCreateFactory)* DWriteCreateFactoryProc;
-  HMODULE dwrite_dll = LoadLibraryW(L"dwrite.dll");
+  HMODULE dwrite_dll = ::LoadLibrary(L"dwrite.dll");
   if (!dwrite_dll) {
     DWORD load_library_get_last_error = GetLastError();
     base::debug::Alias(&dwrite_dll);
@@ -1224,4 +1215,21 @@ bool BuildFontCache(const base::FilePath& file) {
   return BuildFontCacheInternal(file.value().c_str());
 }
 
+void SetDirectWriteFontCache(HANDLE font_cache_section) {
+  g_font_cache_section = font_cache_section;
+}
+
+void InitializeFontLoader() {
+  if (g_font_loader)
+    return;
+
+  HRESULT result = E_FAIL;
+  result = mswr::MakeAndInitialize<FontCollectionLoader>(&g_font_loader);
+  if (FAILED(result) || !g_font_loader) {
+    DCHECK(false);
+    return;
+  }
+  CHECK(g_font_loader->LoadFontListFromRegistry());
+}
+
 }  // namespace content
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index b6258c8..fd5c02d 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -993,6 +993,14 @@ IPC_MESSAGE_ROUTED1(ViewMsg_ForceRedraw,
 IPC_MESSAGE_ROUTED1(ViewMsg_BeginFrame,
                     cc::BeginFrameArgs /* args */)
 
+#if defined(OS_WIN)
+// If DirectWrite is enabled for font rendering then this message contains the
+// font cache section handle valid in the renderer's address space.
+IPC_MESSAGE_CONTROL1(ViewMsg_DirectWriteFontCacheSectionHandle,
+                     base::SharedMemoryHandle /* The font section shared
+                                                 memory handle */)
+#endif
+
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 4bdb420..06b04d2 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -982,11 +982,6 @@ const char kDisableWin32kRendererLockDown[] =
 const char kEnableWin32kRendererLockDown[] =
     "enable-win32k-renderer-lockdown";
 
-// DirectWrite FontCache is shared by browser to renderers using shared memory.
-// This switch allows specifying suffix to shared memory section name to avoid
-// clashes between different instances of Chrome.
-const char kFontCacheSharedMemSuffix[] = "font-cache-shared-mem-suffix";
-
 // Enables the exporting of the tracing events to ETW. This is only supported on
 // Windows Vista and later.
 const char kTraceExportEventsToETW[] = "trace-export-events-to-etw";
diff --git a/content/public/common/content_switches.h b/content/public/common/content_switches.h
index ae8a2c6..ff0694f 100644
--- a/content/public/common/content_switches.h
+++ b/content/public/common/content_switches.h
@@ -292,9 +292,6 @@ CONTENT_EXPORT extern const char kDisableLegacyIntermediateWindow[];
 // mitigation.
 CONTENT_EXPORT extern const char kDisableWin32kRendererLockDown[];
 CONTENT_EXPORT extern const char kEnableWin32kRendererLockDown[];
-// Switch to uniquely identify names shared memory section for font cache
-// across chromium flavors.
-CONTENT_EXPORT extern const char kFontCacheSharedMemSuffix[];
 CONTENT_EXPORT extern const char kTraceExportEventsToETW[];
 #endif
 
diff --git a/content/public/common/dwrite_font_platform_win.h b/content/public/common/dwrite_font_platform_win.h
index 4c988bc..021599c 100644
--- a/content/public/common/dwrite_font_platform_win.h
+++ b/content/public/common/dwrite_font_platform_win.h
@@ -36,6 +36,12 @@ CONTENT_EXPORT bool LoadFontCache(const base::FilePath& path);
 // Added in header mainly for unittest
 CONTENT_EXPORT bool ValidateFontCacheFile(base::File* file);
 
+// DirectWrite Font loader initialization.
+CONTENT_EXPORT void InitializeFontLoader();
+
+// Sets the DirectWrite font cache section handle.
+CONTENT_EXPORT void SetDirectWriteFontCache(HANDLE font_cache_section);
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_DWRITE_FONT_PLATFORM_WIN_H_
diff --git a/content/public/renderer/render_font_warmup_win.h b/content/public/renderer/render_font_warmup_win.h
index 9624d88..a994dbb 100644
--- a/content/public/renderer/render_font_warmup_win.h
+++ b/content/public/renderer/render_font_warmup_win.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_RENDERER_RENDER_FONT_WARMUP_WIN_H_
 #define CONTENT_PUBLIC_RENDERER_RENDER_FONT_WARMUP_WIN_H_
 
+#include <windows.h>
+
 #include "content/common/content_export.h"
 
 class SkFontMgr;
@@ -18,7 +20,15 @@ CONTENT_EXPORT void DoPreSandboxWarmupForTypeface(SkTypeface* typeface);
 
 // Get the shared font manager used during pre-sandbox warmup for DirectWrite
 // fonts.
-CONTENT_EXPORT SkFontMgr* GetPreSandboxWarmupFontMgr();
+CONTENT_EXPORT SkFontMgr* GetDirectWriteFontManager();
+
+// Pre-sandbox font warmup for the DirectWrite font loader.
+CONTENT_EXPORT void DoPreSandboxWarmupForFontLoader();
+
+// Sets the DirectWrite font cache mapped section handle in the renderer
+// process.
+CONTENT_EXPORT void SetDirectWriteFontCacheSectionHandle(
+    HANDLE font_cache_section);
 
 }  // namespace content
 
diff --git a/content/renderer/render_font_warmup_win.cc b/content/renderer/render_font_warmup_win.cc
index 3fc90f1..863b657 100644
--- a/content/renderer/render_font_warmup_win.cc
+++ b/content/renderer/render_font_warmup_win.cc
@@ -11,6 +11,7 @@
 #include "base/win/iat_patch_function.h"
 #include "base/win/windows_version.h"
 #include "content/public/common/dwrite_font_platform_win.h"
+#include "skia/ext/fontmgr_default_win.h"
 #include "third_party/WebKit/public/web/win/WebFontRendering.h"
 #include "third_party/skia/include/core/SkPaint.h"
 #include "third_party/skia/include/ports/SkFontMgr.h"
@@ -131,7 +132,9 @@ void PatchServiceManagerCalls() {
 // before sandbox lock down to allow Skia access to the Font Manager service.
 void CreateDirectWriteFactory(IDWriteFactory** factory) {
   typedef decltype(DWriteCreateFactory)* DWriteCreateFactoryProc;
-  HMODULE dwrite_dll = LoadLibraryW(L"dwrite.dll");
+  HMODULE dwrite_dll = ::GetModuleHandle(L"dwrite.dll");
+  if (!dwrite_dll)
+    dwrite_dll = ::LoadLibrary(L"dwrite.dll");
   // TODO(scottmg): Temporary code to track crash in http://crbug.com/387867.
   if (!dwrite_dll) {
     DWORD load_library_get_last_error = GetLastError();
@@ -179,20 +182,11 @@ void PatchDWriteFactory(IDWriteFactory* factory) {
 
 }  // namespace
 
-void DoPreSandboxWarmupForTypeface(SkTypeface* typeface) {
-  SkPaint paint_warmup;
-  paint_warmup.setTypeface(typeface);
-  wchar_t glyph = L'S';
-  paint_warmup.measureText(&glyph, 2);
-}
-
-SkFontMgr* GetPreSandboxWarmupFontMgr() {
+SkFontMgr* GetDirectWriteFontManager() {
   if (!g_warmup_fontmgr) {
     IDWriteFactory* factory;
     CreateDirectWriteFactory(&factory);
 
-    GetCustomFontCollection(factory);
-
     PatchDWriteFactory(factory);
 
     blink::WebFontRendering::setDirectWriteFactory(factory);
@@ -201,4 +195,15 @@ SkFontMgr* GetPreSandboxWarmupFontMgr() {
   return g_warmup_fontmgr;
 }
 
+void DoPreSandboxWarmupForFontLoader() {
+  InitializeFontLoader();
+}
+
+void SetDirectWriteFontCacheSectionHandle(HANDLE font_cache_section) {
+  SetDirectWriteFontCache(font_cache_section);
+  // The objects used here are intentionally not freed as we want the Skia
+  // code to use these objects after warmup.
+  SetDefaultSkiaFactory(GetDirectWriteFontManager());
+}
+
 }  // namespace content
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 896d5cb..3821ff7d7 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -161,6 +161,7 @@
 #if defined(OS_WIN)
 #include <windows.h>
 #include <objbase.h>
+#include "content/public/renderer/render_font_warmup_win.h"
 #else
 // TODO(port)
 #include "content/child/npapi/np_channel_base.h"
@@ -1379,6 +1380,11 @@ void RenderThreadImpl::PreCacheFontCharacters(const LOGFONT& log_font,
   Send(new ViewHostMsg_PreCacheFontCharacters(log_font, str));
 }
 
+void RenderThreadImpl::OnSetDirectWriteFontCacheHandle(
+    HANDLE font_cache_handle) {
+  content::SetDirectWriteFontCacheSectionHandle(font_cache_handle);
+}
+
 #endif  // OS_WIN
 
 ServiceRegistry* RenderThreadImpl::GetServiceRegistry() {
@@ -1558,6 +1564,10 @@ bool RenderThreadImpl::OnControlMessageReceived(const IPC::Message& msg) {
 #if defined(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER(ViewMsg_PurgePluginListCache, OnPurgePluginListCache)
 #endif
+#if defined(OS_WIN)
+    IPC_MESSAGE_HANDLER(ViewMsg_DirectWriteFontCacheSectionHandle,
+                        OnSetDirectWriteFontCacheHandle)
+#endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index c4f760b..f86e190 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h
@@ -344,6 +344,7 @@ class CONTENT_EXPORT RenderThreadImpl
 #if defined(OS_WIN)
   void PreCacheFontCharacters(const LOGFONT& log_font,
                               const base::string16& str);
+  void OnSetDirectWriteFontCacheHandle(HANDLE font_cache_handle);
 #endif
 
 #if defined(ENABLE_WEBRTC)
diff --git a/content/renderer/renderer_main_platform_delegate_win.cc b/content/renderer/renderer_main_platform_delegate_win.cc
index 6fa56eb..310bf0f 100644
--- a/content/renderer/renderer_main_platform_delegate_win.cc
+++ b/content/renderer/renderer_main_platform_delegate_win.cc
@@ -53,18 +53,8 @@ void SkiaPreCacheFontCharacters(const LOGFONT& logfont,
 }
 
 void WarmupDirectWrite() {
-  // The objects used here are intentionally not freed as we want the Skia
-  // code to use these objects after warmup.
-  SetDefaultSkiaFactory(GetPreSandboxWarmupFontMgr());
-
-  // We need to warm up *some* font for DirectWrite. We also need to pass one
-  // down for the CC HUD code, so use the same one here. Note that we don't use
-  // a monospace as would be nice in an attempt to avoid a small startup time
-  // regression, see http://crbug.com/463613.
-  skia::RefPtr<SkTypeface> hud_typeface = skia::AdoptRef(
-      GetPreSandboxWarmupFontMgr()->legacyCreateTypeface("Times New Roman", 0));
-  DoPreSandboxWarmupForTypeface(hud_typeface.get());
-  gfx::SetHudTypeface(hud_typeface);
+  ::LoadLibrary(L"dwrite.dll");
+  DoPreSandboxWarmupForFontLoader();
 }
 
 }  // namespace
diff --git a/content/shell/browser/shell_content_browser_client.cc b/content/shell/browser/shell_content_browser_client.cc
index fc03843..df97917 100644
--- a/content/shell/browser/shell_content_browser_client.cc
+++ b/content/shell/browser/shell_content_browser_client.cc
@@ -54,6 +54,7 @@
 #if defined(OS_WIN)
 #include "content/common/sandbox_win.h"
 #include "sandbox/win/src/sandbox.h"
+#include "ui/gfx/win/direct_write.h"
 #endif
 
 namespace content {
@@ -406,7 +407,34 @@ void ShellContentBrowserClient::PreSpawnRenderer(sandbox::TargetPolicy* policy,
         sandbox::TargetPolicy::FILES_ALLOW_READONLY,
         base::UTF8ToWide(*i).c_str());
   }
+  AddFontSpecificFSPolicies(policy);
 }
+
+void ShellContentBrowserClient::AddFontSpecificFSPolicies(
+    sandbox::TargetPolicy* policy) {
+  // If DirectWrite is enabled then we need to grant access to the
+  // Windows National Language support directory :-
+  // c:\windows\globalization\sorting. Not having access to this folder
+  // causes DirectWrite font cache setup to fail.
+  if (gfx::win::ShouldUseDirectWrite()) {
+    base::FilePath windows_root;
+    PathService::Get(base::DIR_WINDOWS, &windows_root);
+    base::string16 globalization_path = windows_root.value();
+    globalization_path += L"\\Globalization\\Sorting";
+
+    policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+        sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+        globalization_path.c_str());
+
+    // We need to grant access to subdirectories and files within the
+    // globalization directory.
+    globalization_path += L"\\*";
+    policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+        sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+        globalization_path.c_str());
+  }
+}
+
 #endif  // OS_WIN
 
 ShellBrowserContext* ShellContentBrowserClient::browser_context() {
diff --git a/content/shell/browser/shell_content_browser_client.h b/content/shell/browser/shell_content_browser_client.h
index 0dc59b2..9617e15 100644
--- a/content/shell/browser/shell_content_browser_client.h
+++ b/content/shell/browser/shell_content_browser_client.h
@@ -78,7 +78,11 @@ class ShellContentBrowserClient : public ContentBrowserClient {
       FileDescriptorInfo* mappings) override;
 #endif
 #if defined(OS_WIN)
-  void PreSpawnRenderer(sandbox::TargetPolicy* policy, bool* success) override;
+  void PreSpawnRenderer(sandbox::TargetPolicy* policy,
+                        bool* success) override;
+  // Helper function to add font specific file system policies for renderer
+  // processes. Currently only adds policies if DirectWrite is enabled.
+  static void AddFontSpecificFSPolicies(sandbox::TargetPolicy* policy);
 #endif
 
   ShellBrowserContext* browser_context();
diff --git a/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc b/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc
index 01b9494..96e68aa 100644
--- a/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc
+++ b/content/shell/renderer/layout_test/layout_test_content_renderer_client.cc
@@ -61,7 +61,6 @@ void RegisterSideloadedTypefaces(SkFontMgr* fontmgr) {
        i != files.end();
        ++i) {
     SkTypeface* typeface = fontmgr->createFromFile(i->c_str());
-    DoPreSandboxWarmupForTypeface(typeface);
     blink::WebFontRendering::addSideloadedFontForTesting(typeface);
   }
 }
@@ -76,7 +75,7 @@ LayoutTestContentRendererClient::LayoutTestContentRendererClient() {
 
 #if defined(OS_WIN)
   if (gfx::win::ShouldUseDirectWrite())
-    RegisterSideloadedTypefaces(GetPreSandboxWarmupFontMgr());
+    RegisterSideloadedTypefaces(GetDirectWriteFontManager());
 #endif
 }
 
diff --git a/extensions/DEPS b/extensions/DEPS
index 285b7d3..61251ff 100644
--- a/extensions/DEPS
+++ b/extensions/DEPS
@@ -13,6 +13,8 @@ include_rules = [
   "+grit/extensions_renderer_resources.h",
   "+grit/extensions_resources.h",
   "+testing",
+  "+sandbox/win/src/sandbox.h",
+  "+sandbox/win/src/sandbox_policy.h",
   "+third_party/mojo/src/mojo/public",
   "+third_party/skia/include",
 
diff --git a/extensions/shell/browser/shell_content_browser_client.cc b/extensions/shell/browser/shell_content_browser_client.cc
index 4aba570..c5a8c07 100644
--- a/extensions/shell/browser/shell_content_browser_client.cc
+++ b/extensions/shell/browser/shell_content_browser_client.cc
@@ -40,6 +40,12 @@
 #include "content/public/browser/child_process_data.h"
 #endif
 
+#if defined(OS_WIN)
+#include "base/path_service.h"
+#include "sandbox/win/src/sandbox_policy.h"
+#include "ui/gfx/win/direct_write.h"
+#endif
+
 using base::CommandLine;
 using content::BrowserContext;
 using content::BrowserThread;
@@ -274,6 +280,36 @@ ShellContentBrowserClient::GetDevToolsManagerDelegate() {
   return new content::ShellDevToolsManagerDelegate(GetBrowserContext());
 }
 
+#if defined(OS_WIN)
+// TODO(ananta)
+// Consolidate the policy code below with similar code in
+// content/shell/browser/shell_content_browser_client.h.
+void ShellContentBrowserClient::PreSpawnRenderer(sandbox::TargetPolicy* policy,
+                                                 bool* success) {
+  // If DirectWrite is enabled then we need to grant access to the
+  // Windows National Language support directory :-
+  // c:\windows\globalization\sorting. Not having access to this folder
+  // causes DirectWrite font cache setup to fail.
+  if (gfx::win::ShouldUseDirectWrite()) {
+    base::FilePath windows_root;
+    PathService::Get(base::DIR_WINDOWS, &windows_root);
+    base::string16 globalization_path = windows_root.value();
+    globalization_path += L"\\Globalization\\Sorting";
+
+    policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+        sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+        globalization_path.c_str());
+
+    // We need to grant access to subdirectories and files within the
+    // globalization directory.
+    globalization_path += L"\\*";
+    policy->AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+        sandbox::TargetPolicy::FILES_ALLOW_READONLY,
+        globalization_path.c_str());
+  }
+}
+#endif
+
 ShellBrowserMainParts* ShellContentBrowserClient::CreateShellBrowserMainParts(
     const content::MainFunctionParams& parameters,
     ShellBrowserMainDelegate* browser_main_delegate) {
diff --git a/extensions/shell/browser/shell_content_browser_client.h b/extensions/shell/browser/shell_content_browser_client.h
index f9d813f..44d1113 100644
--- a/extensions/shell/browser/shell_content_browser_client.h
+++ b/extensions/shell/browser/shell_content_browser_client.h
@@ -67,6 +67,11 @@ class ShellContentBrowserClient : public content::ContentBrowserClient {
 
   content::DevToolsManagerDelegate* GetDevToolsManagerDelegate() override;
 
+#if defined(OS_WIN)
+  void PreSpawnRenderer(sandbox::TargetPolicy* policy,
+                        bool* success) override;
+#endif
+
  protected:
   // Subclasses may wish to provide their own ShellBrowserMainParts.
   virtual ShellBrowserMainParts* CreateShellBrowserMainParts(