Example of how to interpose yourself in a message stream.

content/common/child_thread.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/child_thread.h"
 
 #include "base/message_loop.h"
 #include "base/string_util.h"
 #include "base/command_line.h"
 #include "content/common/child_process.h"
 #include "content/common/child_process_messages.h"
 #include "content/common/child_trace_message_filter.h"
 #include "content/common/content_switches.h"
 #include "content/common/file_system/file_system_dispatcher.h"
 #include "content/common/notification_service.h"
 #include "content/common/quota_dispatcher.h"
 #include "content/common/resource_dispatcher.h"
+#include "content/common/set_ipc_fuzzing.h"
 #include "content/common/socket_stream_dispatcher.h"
 #include "ipc/ipc_logging.h"
 #include "ipc/ipc_sync_channel.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "ipc/ipc_switches.h"
 #include "webkit/glue/webkit_glue.h"
 
 ChildThread::ChildThread() {
   channel_name_ = CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
       switches::kProcessChannelID);
@@ skipping 31 matching lines @@
   sync_message_filter_ =
       new IPC::SyncMessageFilter(ChildProcess::current()->GetShutDownEvent());
   channel_->AddFilter(sync_message_filter_.get());
 
 #if !defined(NACL_WIN64)
   // This brings in a depenency on gpu, which isn't linked in with NaCl's win64
   // build.
   channel_->AddFilter(new ChildTraceMessageFilter());
 #endif
 
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableIPCFuzzing)) {
+    SetIPCFuzzing(channel_.get());

[jam, 2011/04/27 21:58:07]

the code that you added in content should be in chrome layer instead I think,
since content is the bare minimum for rendering a page using a multi-process
browser.  and I think you'll want this in chrome layer anyways in case you want
to do something special with chrome IPCs that the content layer doesn't know
about.

+  }
+
   // When running in unit tests, there is already a NotificationService object.
   // Since only one can exist at a time per thread, check first.
   if (!NotificationService::current())
     notification_service_.reset(new NotificationService);
 }
 
 ChildThread::~ChildThread() {
 #ifdef IPC_MESSAGE_LOG_ENABLED
   IPC::Logging::GetInstance()->SetIPCSender(NULL);
 #endif
@@ skipping 126 matching lines @@
     MessageLoop::current()->Quit();
     return;
   }
 
   // The child process shutdown sequence is a request response based mechanism,
   // where we send out an initial feeler request to the child process host
   // instance in the browser to verify if it's ok to shutdown the child process.
   // The browser then sends back a response if it's ok to shutdown.
   Send(new ChildProcessHostMsg_ShutdownRequest);
 }