Don't crash the browser when a webui page misbehaves

content/browser/webui/web_ui_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/webui/web_ui_impl.h"
 
+#include "base/debug/dump_without_crashing.h"
 #include "base/json/json_writer.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/renderer_host/dip_util.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_contents/web_contents_view.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/common/view_messages.h"
@@ skipping 192 matching lines @@
 
 void WebUIImpl::AddMessageHandler(WebUIMessageHandler* handler) {
   DCHECK(!handler->web_ui());
   handler->set_web_ui(this);
   handler->RegisterMessages();
   handlers_.push_back(handler);
 }
 
 void WebUIImpl::ExecuteJavascript(const base::string16& javascript) {
   RenderFrameHost* target_frame = TargetFrame();
-  if (target_frame)
+  if (target_frame) {
+    if (!(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+              target_frame->GetProcess()->GetID()) ||
+          // It's possible to load about:blank in a Web UI renderer.
+          // See http://crbug.com/42547
+          target_frame->GetLastCommittedURL().spec() == url::kAboutBlankURL)) {
+      // Don't crash when we try to inject JavaScript into a non-WebUI page, but
+      // upload a crash report anyways. http://crbug.com/516690
+      base::debug::DumpWithoutCrashing();
+      return;
+    }
     target_frame->ExecuteJavaScript(javascript);
+  }
 }
 
 RenderFrameHost* WebUIImpl::TargetFrame() {
   if (frame_name_.empty())
     return web_contents_->GetMainFrame();
 
   std::set<RenderFrameHost*> frame_set;
   web_contents_->ForEachFrame(base::Bind(&WebUIImpl::AddToSetIfFrameNameMatches,
                                          base::Unretained(this),
                                          &frame_set));
 
   // It happens that some sub-pages attempt to send JavaScript messages before
   // their frames are loaded.
   DCHECK_GE(1U, frame_set.size());
   if (frame_set.empty())
     return NULL;
   return *frame_set.begin();
 }
 
 void WebUIImpl::AddToSetIfFrameNameMatches(
     std::set<RenderFrameHost*>* frame_set,
     RenderFrameHost* host) {
   if (host->GetFrameName() == frame_name_)
     frame_set->insert(host);
 }
 
 }  // namespace content