Index: content/renderer/render_frame_impl.cc |
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc |
index 2f419abd1c281a6440243692b8bf1172c357a28d..8b6f632480a388522faa7b28d1ceab426765ae1d 100644 |
--- a/content/renderer/render_frame_impl.cc |
+++ b/content/renderer/render_frame_impl.cc |
@@ -397,6 +397,13 @@ bool IsBrowserInitiated(NavigationParams* pending) { |
!pending->common_params.url.SchemeIs(url::kJavaScriptScheme); |
} |
+NOINLINE void ExhaustMemory() { |
+ volatile void* ptr = nullptr; |
+ do { |
+ ptr = malloc(0x10000000); |
+ } while (ptr); |
+} |
+ |
NOINLINE void CrashIntentionally() { |
// NOTE(shess): Crash directly rather than using NOTREACHED() so |
// that the signature is easier to triage in crash reports. |
@@ -506,6 +513,11 @@ void MaybeHandleDebugURL(const GURL& url) { |
LOG(ERROR) << "Intentionally sleeping renderer for 20 seconds" |
<< " because user navigated to " << url.spec(); |
base::PlatformThread::Sleep(base::TimeDelta::FromSeconds(20)); |
+ } else if (url == GURL(kChromeUIMemoryExhaustURL)) { |
+ LOG(ERROR) |
+ << "Intentionally exhausting renderer memory because user navigated to " |
+ << url.spec(); |
+ ExhaustMemory(); |
} |
#if defined(ADDRESS_SANITIZER) || defined(SYZYASAN) |