DevTools: do not CHECK devtools messages received from renderer in the browser, issue bad_message i…

content/browser/devtools/render_frame_devtools_agent_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 
 #include <tuple>
 #include <utility>
 
 #include "base/lazy_instance.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/devtools_frame_trace_recorder.h"
 #include "content/browser/devtools/devtools_protocol_handler.h"
 #include "content/browser/devtools/page_navigation_throttle.h"
 #include "content/browser/devtools/protocol/browser_handler.h"
 #include "content/browser/devtools/protocol/dom_handler.h"
 #include "content/browser/devtools/protocol/emulation_handler.h"
 #include "content/browser/devtools/protocol/input_handler.h"
 #include "content/browser/devtools/protocol/inspector_handler.h"
 #include "content/browser/devtools/protocol/io_handler.h"
@@ skipping 75 matching lines @@
   RenderFrameHostImpl* host() const { return host_; }
 
   void Attach();
   void Reattach(FrameHostHolder* old);
   void Detach();
   void DispatchProtocolMessage(int session_id,
                                int call_id,
                                const std::string& method,
                                const std::string& message);
   void InspectElement(int session_id, int x, int y);
-  void ProcessChunkedMessageFromAgent(const DevToolsMessageChunk& chunk);
+  bool ProcessChunkedMessageFromAgent(const DevToolsMessageChunk& chunk);
   void Suspend();
   void Resume();
 
  private:
   void GrantPolicy();
   void RevokePolicy();
   void SendMessageToClient(int session_id, const std::string& message);
 
   RenderFrameDevToolsAgentHost* agent_;
   RenderFrameHostImpl* host_;
@@ skipping 91 matching lines @@
   sent_messages_[call_id] = { session_id, method, message };
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::InspectElement(
     int session_id, int x, int y) {
   DCHECK(attached_);
   host_->Send(new DevToolsAgentMsg_InspectElement(
       host_->GetRoutingID(), session_id, x, y));
 }
 
-void
+bool
 RenderFrameDevToolsAgentHost::FrameHostHolder::ProcessChunkedMessageFromAgent(
     const DevToolsMessageChunk& chunk) {
-  chunk_processor_.ProcessChunkedMessageFromAgent(chunk);
+  return chunk_processor_.ProcessChunkedMessageFromAgent(chunk);
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::SendMessageToClient(
     int session_id,
     const std::string& message) {
   sent_messages_.erase(chunk_processor_.last_call_id());
   if (suspended_)
     pending_messages_.push_back(std::make_pair(session_id, message));
   else
     agent_->SendMessageToClient(session_id, message);
@@ skipping 674 matching lines @@
   if (frame_trace_recorder_ && tracing_handler_->did_initiate_recording()) {
     frame_trace_recorder_->OnSynchronousSwapCompositorFrame(
         current_ ? current_->host() : nullptr,
         frame_metadata);
   }
 }
 
 void RenderFrameDevToolsAgentHost::OnDispatchOnInspectorFrontend(
     RenderFrameHost* sender,
     const DevToolsMessageChunk& message) {
+  bool success = true;
   if (current_ && current_->host() == sender)
-    current_->ProcessChunkedMessageFromAgent(message);
+    success = current_->ProcessChunkedMessageFromAgent(message);
   else if (pending_ && pending_->host() == sender)
-    pending_->ProcessChunkedMessageFromAgent(message);
+    success = pending_->ProcessChunkedMessageFromAgent(message);
+  if (!success) {
+    bad_message::ReceivedBadMessage(
+        sender->GetProcess(),
+        bad_message::RFH_INCONSISTENT_DEVTOOLS_MESSAGE);
+  }
 }
 
 void RenderFrameDevToolsAgentHost::OnRequestNewWindow(
     RenderFrameHost* sender,
     int new_routing_id) {
   RenderFrameHostImpl* frame_host = RenderFrameHostImpl::FromID(
       sender->GetProcess()->GetID(), new_routing_id);
 
   bool success = false;
   if (IsAttached() && sender->GetRoutingID() != new_routing_id && frame_host) {
@@ skipping 11 matching lines @@
     RenderFrameHost* host) {
   return (current_ && current_->host() == host) ||
       (pending_ && pending_->host() == host);
 }
 
 bool RenderFrameDevToolsAgentHost::IsChildFrame() {
   return current_ && current_->host()->GetParent();
 }
 
 }  // namespace content