Generate dumps for relevant renderers when users kill a hung pepper plugin.

chrome/browser/hang_monitor/hang_crash_dump_win.cc

Index: chrome/browser/hang_monitor/hang_crash_dump_win.cc
diff --git a/chrome/browser/hang_monitor/hang_crash_dump_win.cc b/chrome/browser/hang_monitor/hang_crash_dump_win.cc
index c2a910bdb304326164676529bf9fa6c13cc07708..c327519c3e8e24d231a7a1fec5e3bd0ac40853a8 100644
--- a/chrome/browser/hang_monitor/hang_crash_dump_win.cc
+++ b/chrome/browser/hang_monitor/hang_crash_dump_win.cc
@@ -7,6 +7,7 @@
 #include "base/logging.h"
 #include "chrome/common/chrome_constants.h"
 #include "content/public/common/result_codes.h"
+#include "ppapi/shared_impl/ppapi_message_tracker.h"
 
 namespace {
 
@@ -16,6 +17,20 @@ static const int kTerminateTimeoutMS = 2000;
 // How long do we wait for the crash to be generated (in ms).
 static const int kGenerateDumpTimeoutMS = 10000;
 
+DWORD WINAPI DumpIfHandlingPepper(void*) {
+  typedef void (__cdecl *DumpFunction)();
+  if (ppapi::PpapiMessageTracker::GetInstance()->IsHandlingMessage()) {
+    DumpFunction request_dump = reinterpret_cast<DumpFunction>(GetProcAddress(
+        GetModuleHandle(chrome::kBrowserProcessExecutableName),
+        "DumpProcessWithoutCrash"));
+    DCHECK(request_dump) << "Failed loading DumpProcessWithoutCrash: error " <<
+        GetLastError();
+    if (request_dump)
+      request_dump();
+  }
+  return 0;
+}
+
 }  // namespace
 
 void CrashDumpAndTerminateHungChildProcess(HANDLE hprocess) {
@@ -44,3 +59,25 @@ void CrashDumpAndTerminateHungChildProcess(HANDLE hprocess) {
   TerminateProcess(hprocess, content::RESULT_CODE_HUNG);
   WaitForSingleObject(hprocess, kTerminateTimeoutMS);
 }
+
+void CrashDumpIfProcessHandlingPepper(HANDLE hprocess) {
+  // Unlike CrashDumpAndTerminateHungChildProcess() which creates a remote
+  // thread using function pointer relative to chrome.exe, here we create a
+  // remote thread using function pointer relative to chrome.dll. The reason is
+  // that there are separate PpapiMessageTracker singletons for chrome.dll and
+  // chrome.exe (in non-component build). We cannot access the information
+  // collected by PpapiMessageTracker of chrome.dll in chrome.exe.
+  //
+  // This is less safe, because chrome.dll may be loaded at different addresses
+  // in different processes. We could cause crash in that case. However, it
+  // should be rare and we are only doing this temporarily for debugging on the
+  // Canary channel.
+  HANDLE remote_thread = CreateRemoteThread(hprocess, NULL, 0,
+                                            DumpIfHandlingPepper, 0, 0, NULL);
+  DCHECK(remote_thread) << "Failed creating remote thread: error " <<
+      GetLastError();
+  if (remote_thread) {
+    WaitForSingleObject(remote_thread, kGenerateDumpTimeoutMS);
+    CloseHandle(remote_thread);
+  }
+}