Create crash dump if a bad IPC message is received.

content/browser/browser_child_process_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_child_process_host_impl.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/files/file_path.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/synchronization/waitable_event.h"
 #include "content/browser/histogram_message_filter.h"
 #include "content/browser/loader/resource_message_filter.h"
@@ skipping 227 matching lines @@
 
 void BrowserChildProcessHostImpl::OnBadMessageReceived(
     const IPC::Message& message) {
   HistogramBadMessageTerminated(data_.process_type);
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableKillAfterBadIPC)) {
     return;
   }
   LOG(ERROR) << "Terminating child process for bad IPC message of type "
       << message.type();
+
+  // If content is hosted within a process that has set a dump without crashing

[jam, 2015/04/06 16:00:04]

I don't understand what this comment means? i.e. this code always runs in the
browser process, so why does the comment make it seem like what will happen next
depends on the process?

[jam, 2015/04/06 21:26:06]

yeah, that would be clearer. or also take out the first sentence entirely since
it's redundant (we don't want to have to retype that each time code in content
or base calls DumpWithoutCrashing)

+  // function, then create a memory dump. This will contain enough stack frames
+  // to work out what the bad message was.
+  base::debug::DumpWithoutCrashing();
+
   child_process_->GetProcess().Terminate(RESULT_CODE_KILLED_BAD_MESSAGE, false);
 }
 
 bool BrowserChildProcessHostImpl::CanShutdown() {
   return delegate_->CanShutdown();
 }
 
 void BrowserChildProcessHostImpl::OnChildDisconnected() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 #if defined(OS_WIN)
@@ skipping 75 matching lines @@
 
 #if defined(OS_WIN)
 
 void BrowserChildProcessHostImpl::OnObjectSignaled(HANDLE object) {
   OnChildDisconnected();
 }
 
 #endif
 
 }  // namespace content