The RC graph is totally opaque, which is a liability the more we use the graph to reason about Chrome's performance. It's pretty easy to add a graph view to the chrome://discards UI, given the expressive power of D3.js.
After a long discussion with chrome-eng-review and security@chromium.org, the way this can be put together is:
1. Host D3.js on a Google-controlled domain.
2. Render the graph in a webview.
3. Provide the main body document for the vebview in a data: URL.
4. Load D3.js with subresource integrity into the above main body document.
5. Communicate with the webview using postMessage.
This way:
1. We don't bloat Chrome's installer or on-disk footprint for users that don't use this debug page.
2. The WebUI renderer never loads content from the network, which could compromise a privileged process.
3. The graph data is never on the network.
4. Realtime updates are a piece of cake.
Comment 1 by bugdroid1@chromium.org
, Oct 5