| Index: content/browser/renderer_host/render_process_host_impl.cc
|
| diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
|
| index dde83fd48bb4059ecba4525cb58ccaa2330cf29e..2d4ffb7b2b30044b06750bcc918e1612baa503ee 100644
|
| --- a/content/browser/renderer_host/render_process_host_impl.cc
|
| +++ b/content/browser/renderer_host/render_process_host_impl.cc
|
| @@ -3142,6 +3142,14 @@ void RenderProcessHostImpl::ProcessDied(bool already_dead,
|
| }
|
| }
|
|
|
| + if (exit_code == RESULT_CODE_KILLED_BAD_MESSAGE) {
|
| + // If a renderer sent a bad message, then revoke all the capabilities it was
|
| + // previously given.
|
| + // http://crbug.com/726142
|
| + ChildProcessSecurityPolicyImpl::GetInstance()->Remove(id_);
|
| + ChildProcessSecurityPolicyImpl::GetInstance()->Add(id_);
|
| + }
|
| +
|
| RendererClosedDetails details(status, exit_code);
|
|
|
| child_process_launcher_.reset();
|
|
|