Index: content/browser/renderer_host/render_process_host_impl.cc |
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc |
index dde83fd48bb4059ecba4525cb58ccaa2330cf29e..2d4ffb7b2b30044b06750bcc918e1612baa503ee 100644 |
--- a/content/browser/renderer_host/render_process_host_impl.cc |
+++ b/content/browser/renderer_host/render_process_host_impl.cc |
@@ -3142,6 +3142,14 @@ void RenderProcessHostImpl::ProcessDied(bool already_dead, |
} |
} |
+ if (exit_code == RESULT_CODE_KILLED_BAD_MESSAGE) { |
+ // If a renderer sent a bad message, then revoke all the capabilities it was |
+ // previously given. |
+ // http://crbug.com/726142 |
+ ChildProcessSecurityPolicyImpl::GetInstance()->Remove(id_); |
+ ChildProcessSecurityPolicyImpl::GetInstance()->Add(id_); |
+ } |
+ |
RendererClosedDetails details(status, exit_code); |
child_process_launcher_.reset(); |