IPC fuzzer child process component

content/browser/renderer_host/render_process_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Represents the browser side of the browser <--> renderer communication
 // channel. There will be one RenderProcessHost per renderer process.
 
 #include "content/browser/renderer_host/render_process_host_impl.h"
 
 #include <algorithm>
@@ skipping 751 matching lines @@
   // The post task to this thread with the process id could be in queue, and we
   // don't want to dispatch a message before then since it will need the handle.
   if (child_process_launcher_.get() && child_process_launcher_->IsStarting())
     return false;
 
   return widget_helper_->WaitForBackingStoreMsg(render_widget_id,
                                                 max_delay, msg);
 }
 
 void RenderProcessHostImpl::ReceivedBadMessage() {
+  // The embedder can override the decision to kill the child process.
+  if (!GetContentClient()->browser()->ShouldKillChildOnBadMessage())
+    return;
+
   if (run_renderer_in_process()) {
     // In single process mode it is better if we don't suicide but just
     // crash.
     CHECK(false);
   }
   // We kill the renderer but don't include a NOTREACHED, because we want the
   // browser to try to survive when it gets illegal messages from the renderer.
   base::KillProcess(GetHandle(), RESULT_CODE_KILLED_BAD_MESSAGE,
                     false);
 }
@@ skipping 996 matching lines @@
     // Skip widgets in other processes.
     if (widgets[i]->GetProcess()->GetID() != GetID())
       continue;
 
     RenderViewHost* rvh = RenderViewHost::From(widgets[i]);
     rvh->UpdateWebkitPreferences(rvh->GetWebkitPreferences());
   }
 }
 
 }  // namespace content