Kill child processes on bad Mojo messages

content/browser/renderer_host/render_process_host_impl.cc

Index: content/browser/renderer_host/render_process_host_impl.cc
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index c6ee319c3f781f8a09e389c4fa06e16d5fbb0280..46087dfacff65046afa5d9b391559fb1a50f5740 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -784,7 +784,9 @@ bool RenderProcessHostImpl::Init() {
     // at this stage.
     child_process_launcher_.reset(new ChildProcessLauncher(
         new RendererSandboxedProcessLauncherDelegate(channel_.get()), cmd_line,
-        GetID(), this, child_token_));
+        GetID(), this, child_token_,
+        base::Bind(&RenderProcessHostImpl::OnMojoProcessError,
+                   weak_factory_.GetWeakPtr())));
 
     fast_shutdown_started_ = false;
   }
@@ -2627,6 +2629,15 @@ void RenderProcessHostImpl::OnProcessLaunchFailed(int error_code) {
   ProcessDied(true, &details);
 }
 
+void RenderProcessHostImpl::OnMojoProcessError(const std::string& error) {
+  // The ReceivedBadMessage call below will trigger a DumpWithoutCrashing. Alias
+  // enough information here so that we can determine what the bad message was.
+  base::debug::Alias(&error);
+  bad_message::ReceivedBadMessage(this,
+                                  bad_message::RPH_MOJO_PROCESS_ERROR);
+  LOG(ERROR) << "Killing render process process: " << error;

[jam, 2016/06/13 18:30:39]

nit: no need, since bad_message::ReceivedBadMessage does this

[Ken Rockot(use gerrit already), 2016/06/13 22:36:40]

The message logged by ReceivedBadMessage is not particularly useful for a
developer encountering this. The message here may include details about the
specific Mojo interface and method name which triggered the error.

+}
+
 scoped_refptr<AudioRendererHost> RenderProcessHostImpl::audio_renderer_host()
     const {
   return audio_renderer_host_;