Create crash dump if a bad IPC message is received.

content/browser/browser_child_process_host_impl.cc

Index: content/browser/browser_child_process_host_impl.cc
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index 08486fc7fa4c51c6284a25a35ae38b7d80f654c8..3d233ad64d664eca48d89d33edc9e00736b864c2 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -7,6 +7,7 @@
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/files/file_path.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ -254,6 +255,12 @@ void BrowserChildProcessHostImpl::OnBadMessageReceived(
   }
   LOG(ERROR) << "Terminating child process for bad IPC message of type "
       << message.type();
+
+  // If content is hosted within a process that has set a dump without crashing

[jam, 2015/04/06 16:00:04]

I don't understand what this comment means? i.e. this code always runs in the
browser process, so why does the comment make it seem like what will happen next
depends on the process?

[jam, 2015/04/06 21:26:06]

yeah, that would be clearer. or also take out the first sentence entirely since
it's redundant (we don't want to have to retype that each time code in content
or base calls DumpWithoutCrashing)

+  // function, then create a memory dump. This will contain enough stack frames
+  // to work out what the bad message was.
+  base::debug::DumpWithoutCrashing();
+
   child_process_->GetProcess().Terminate(RESULT_CODE_KILLED_BAD_MESSAGE, false);
 }