Ensure that any IPC sent from a child process that couldn't be deserialized causes that p…

content/browser/browser_child_process_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_child_process_host_impl.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
@@ skipping 201 matching lines @@
   child_process_host_->AddFilter(filter->GetFilter());
 }
 
 void BrowserChildProcessHostImpl::NotifyProcessInstanceCreated(
     const ChildProcessData& data) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   FOR_EACH_OBSERVER(BrowserChildProcessObserver, g_observers.Get(),
                     BrowserChildProcessInstanceCreated(data));
 }
 
+void BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
+    int process_type) {
+  UMA_HISTOGRAM_ENUMERATION("ChildProcess.BadMessgeTerminated", process_type,
+                            PROCESS_TYPE_MAX);
+}
+
 base::TerminationStatus BrowserChildProcessHostImpl::GetTerminationStatus(
     bool known_dead, int* exit_code) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (!child_process_)  // If the delegate doesn't use Launch() helper.
     return base::GetTerminationStatus(data_.handle, exit_code);
   return child_process_->GetChildTerminationStatus(known_dead,
                                                    exit_code);
 }
 
 bool BrowserChildProcessHostImpl::OnMessageReceived(
@@ skipping 13 matching lines @@
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
                           base::Bind(&NotifyProcessHostConnected, data_));
 
   delegate_->OnChannelConnected(peer_pid);
 }
 
 void BrowserChildProcessHostImpl::OnChannelError() {
   delegate_->OnChannelError();
 }
 
+void BrowserChildProcessHostImpl::OnBadMessageReceived(
+    const IPC::Message& message) {
+  HistogramBadMessageTerminated(data_.process_type);
+  base::KillProcess(GetHandle(), RESULT_CODE_KILLED_BAD_MESSAGE, false);
+}
+
 bool BrowserChildProcessHostImpl::CanShutdown() {
   return delegate_->CanShutdown();
 }
 
 void BrowserChildProcessHostImpl::OnChildDisconnected() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   if (child_process_.get() || data_.handle) {
     DCHECK(data_.handle != base::kNullProcessHandle);
     int exit_code;
     base::TerminationStatus status = GetTerminationStatus(
@@ skipping 82 matching lines @@
 
 void BrowserChildProcessHostImpl::OnProcessExitedEarly(
     base::WaitableEvent* event) {
   DeleteProcessWaitableEvent(event);
   OnChildDisconnected();
 }
 
 #endif
 
 }  // namespace content