IndexedDB: Reject bad OnDestroyed messages

content/browser/indexed_db/indexed_db_dispatcher_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/guid.h"
@@ skipping 596 matching lines @@
       parent_->GetOrTerminateProcess(&map_, ipc_database_id);
   if (!connection || !connection->IsConnected())
     return;
   connection->VersionChangeIgnored();
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
-  IndexedDBConnection* connection = map_.Lookup(ipc_object_id);
+  IndexedDBConnection* connection =
+      parent_->GetOrTerminateProcess(&map_, ipc_object_id);

[cmumford, 2015/01/26 19:52:15]

This still dies on non-official builds right? Will that satisfy ASan if it's
still a failed DCHECK?

[jsbell, 2015/01/26 19:57:22]

Given that we do this for the other IPCs, but *this* one was called out, I'm
guessing the fuzzer is looking for unexpected exits and the other ones are doing
the right thing (i.e. in release builds, BadMessageReceived()).

I'll ask inferno@

+  if (!connection)
+    return;
   if (connection->IsConnected())
     connection->Close();
   parent_->Context()
       ->ConnectionClosed(database_url_map_[ipc_object_id], connection);
   database_url_map_.erase(ipc_object_id);
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnGet(
     const IndexedDBHostMsg_DatabaseGet_Params& params) {
@@ skipping 394 matching lines @@
 }
 
 void IndexedDBDispatcherHost::CursorDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
   parent_->DestroyObject(&map_, ipc_object_id);
 }
 
 }  // namespace content