IndexedDB: Reject bad OnDestroyed messages

content/browser/indexed_db/indexed_db_dispatcher_host.cc

Index: content/browser/indexed_db/indexed_db_dispatcher_host.cc
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host.cc b/content/browser/indexed_db/indexed_db_dispatcher_host.cc
index 02bf1977907d8cb56e95ef1844e5865073f926c9..302adbcca2413eee0f69fab02339186730917bac 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host.cc
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host.cc
@@ -614,7 +614,10 @@ void IndexedDBDispatcherHost::DatabaseDispatcherHost::OnDestroyed(
     int32 ipc_object_id) {
   DCHECK(
       parent_->indexed_db_context_->TaskRunner()->RunsTasksOnCurrentThread());
-  IndexedDBConnection* connection = map_.Lookup(ipc_object_id);
+  IndexedDBConnection* connection =
+      parent_->GetOrTerminateProcess(&map_, ipc_object_id);

[cmumford, 2015/01/26 19:52:15]

This still dies on non-official builds right? Will that satisfy ASan if it's
still a failed DCHECK?

[jsbell, 2015/01/26 19:57:22]

Given that we do this for the other IPCs, but *this* one was called out, I'm
guessing the fuzzer is looking for unexpected exits and the other ones are doing
the right thing (i.e. in release builds, BadMessageReceived()).

I'll ask inferno@

+  if (!connection)
+    return;
   if (connection->IsConnected())
     connection->Close();
   parent_->Context()